← All advisories

Medium severity4.0OSV Advisory· Published Apr 28, 2024· Updated Apr 15, 2026

CVE-2024-33883

CVE-2024-33883

Description

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
ejsnpm	< 3.1.10	3.1.10

Affected products

4

Ejs/EjsOSV
Range: v2.0.1, v2.0.2, v2.1.1, …
osv-coords3 versions
pkg:apk/chainguard/lerna pkg:apk/wolfi/lerna pkg:npm/ejs
< 8.1.3-r0+ 2 more
- (no CPE)range: < 8.1.3-r0
- (no CPE)range: < 8.1.3-r0
- (no CPE)range: < 3.1.10

Patches

Vulnerability mechanics

References

6

github.com/advisories/GHSA-ghr5-ch3p-vcr6ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-33883ghsaADVISORY
github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5nvdWEB
github.com/mde/ejs/compare/v3.1.9...v3.1.10nvdWEB
security.netapp.com/advisory/ntap-20240605-0003ghsaWEB
security.netapp.com/advisory/ntap-20240605-0003/nvd

News mentions

0

No linked articles in our index yet.