koajs / koajs/ejs

koa-ejs Depends on vulnerable versions of ejs

Open
#71 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
248
Forks
51
PR merge metrics
No merged PRs in 30d

Description

Please update ejs dependency to ^3.1.10

ejs <=3.1.9
Severity: critical
ejs template injection vulnerability - https://github.com/advisories/GHSA-phwq-j96m-2c2q
ejs lacks certain pollution protection - https://github.com/advisories/GHSA-ghr5-ch3p-vcr6

Contributor guide

Open the contributing guide

Research direction

Locate the ejs dependency declaration in the repository and check how the resolved version is recorded. Update it to ^3.1.10, then run the existing test suite; done means the vulnerable version is no longer resolved and the tests pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.