Security vulnerabilities and automated fixes for ssti issues
2 posts found
A critical server-side template injection vulnerability (CVE-2022-29078) was discovered in EJS version 3.1.6, allowing attackers to execute arbitrary code on the server through the `outputFunctionName` option. This vulnerability was fixed by upgrading EJS from 3.1.6 to 3.1.7 in the react-redux-bad-algo project, eliminating a dangerous remote code execution vector.
A critical Server-Side Template Injection (SSTI) vulnerability in the banks library (CVE-2026-44209) could allow remote attackers to execute arbitrary code through template processing. The vulnerability was fixed by upgrading from banks 2.4.0 to 2.4.2, which patches the unsafe template handling in request handlers that process user-influenced input.