Transitive vulnerability in ejs v3.1.8
filiar opened this issue · comments
BlackDuck scan reports medium security risk in ejs v3.1.8 (transitive dependency for oclif/core v2.15.0).
Description
ejs is vulnerable to server-side template injection (SSTI) leading to remote code execution (RCE) when an application using ejs has user controlled input passed directly into the res.render() function. This could allow a remote attacker to execute commands on the underlying web server of such an application.
There is a fix available in ejs v3.1.8.
Could you please migrate to using the recommended ejs version.
Kind Regards!
Iliya
Hi @filiar
We are already using ejs@3.1.8 in oclif/core:
Also, ejs explicitly list this kind of reports as out of scope in its security policy, see:
https://github.com/mde/ejs/security#out-of-scope-vulnerabilities
Hi, @cristiand391.
Thank you for the prompt response. BlackDuck is reporting v3.1.8 as containing security risk. It is my mistake and the fix is in v3.1.9.
Our security team is pressing us to act on that. So if you can revise, switching to ejs v3.1.9.
Kind Regards,
Iliya
Our security team is pressing us to act on that. So if you can revise, switching to ejs v3.1.9.
@filiar yeah, we get those security scanner alerts from other customers in our CLI too 😄 . Seems it just a minor bump anyway, I'll merge your PR next week. Thanks!