koa-ejs Depends on vulnerable versions of ejs
Open
- Dominant language
- JavaScript
- Stars
- 248
- Forks
- 51
- PR merge metrics
- No merged PRs in 30d
Description
Please update ejs dependency to ^3.1.10
ejs <=3.1.9
Severity: critical
ejs template injection vulnerability - https://github.com/advisories/GHSA-phwq-j96m-2c2q
ejs lacks certain pollution protection - https://github.com/advisories/GHSA-ghr5-ch3p-vcr6
Contributor guide
Research direction
Locate the ejs dependency declaration in the repository and check how the resolved version is recorded. Update it to ^3.1.10, then run the existing test suite; done means the vulnerable version is no longer resolved and the tests pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100