CVE-2023-29827

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

5.55% chance of exploitation in the next 30 days, 92th percentile

Nuclei

critical · CWE-74

Published

2023-05-04

Updated

2025-01-29

Proof-of-concept exploits (3)

• mde/ejs/issues/720
• NketiahGodfred/EJS-ssti-exploit1★ · 2024-12-01
• momrulhasan/ejs-ssti-shell-spawner0★ · 2025-07-08

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29827.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2023-26105
• CVE-2019-1010174
• CVE-2022-29078
• CVE-2024-6782
• CVE-2023-29824
• CVE-2023-2983