VYPR
Get started
← All advisories
Medium severity4.0NVD Advisory· Published Apr 28, 2024· Updated Apr 15, 2026

CVE-2024-33883

CVE-2024-33883

Description

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ejsnpm
< 3.1.103.1.10

Patches

2
e469741dca7d

Basic pollution protection

https://github.com/mde/ejsmdeApr 12, 2024via ghsa
commit
2 files changed · +12 −2
  • lib/ejs.js+3 −2 modified
    @@ -506,8 +506,8 @@ exports.clearCache = function () {
   exports.cache.reset();
 };
 
-function Template(text, opts) {
-  opts = opts || utils.createNullProtoObjWherePossible();
+function Template(text, optsParam) {
+  var opts = utils.hasOwnOnlyObject(optsParam);
   var options = utils.createNullProtoObjWherePossible();
   this.templateText = text;
   /** @type {string | null} */
@@ -949,3 +949,4 @@ exports.name = _NAME;
 if (typeof window != 'undefined') {
   window.ejs = exports;
 }
+
  • lib/utils.js+9 −0 modified
    @@ -238,4 +238,13 @@ exports.createNullProtoObjWherePossible = (function () {
   };
 })();
 
+exports.hasOwnOnlyObject = function (obj) {
+  var o = exports.createNullProtoObjWherePossible();
+  for (var p in obj) {
+    if (hasOwn(obj, p)) {
+      o[p] = obj[p];
+    }
+  }
+  return o;
+};
d3f807dea9ce
https://github.com/mde/ejsvia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.