Security vulnerabilities and automated fixes for ssti issues
2 posts found
CVE-2022-29078 is a critical server-side template injection (SSTI) vulnerability in EJS versions prior to 3.1.7, where the `outputFunctionName` option is passed directly into generated code without sanitization, allowing attackers to execute arbitrary JavaScript on the server. The fix upgrades the EJS dependency from 2.7.4 to 3.1.7+ (resolved here as 6.0.1), eliminating the unsafe code generation path. Any Node.js application rendering EJS templates with user-influenced options is at risk of ful
A critical Server-Side Template Injection (SSTI) vulnerability in the banks library (CVE-2026-44209) could allow remote attackers to execute arbitrary code through template processing. The vulnerability was fixed by upgrading from banks 2.4.0 to 2.4.2, which patches the unsafe template handling in request handlers that process user-influenced input.