CVE-2024-33883

ejs lacks certain pollution protection

4.0 MediumPublic exploitFix available

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.61%Up 0.6 points since Apr 29, 2024

What each source reports

CVE List Score used 4.0

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Record: CVE-2024-33883
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-693
Updated: 2026-11-02

EUVDEUVD-2024-1209 4.0

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Record: EUVD-2024-1209
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ghr5-ch3p-vcr6 6.9

ejs lacks certain pollution protection

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Record: GHSA-ghr5-ch3p-vcr6
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-693, CWE-1321
Updated: 2026-11-02

NVD 4.0

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Record: CVE-2024-33883
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-693
Updated: 2026-11-02

OSV 4.0

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Record: CVE-2024-33883
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-33883 4.0

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Record: DEBIAN-CVE-2024-33883
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Show 6 moreShow less

OSVGHSA-ghr5-ch3p-vcr6 6.9

ejs lacks certain pollution protection

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Record: GHSA-ghr5-ch3p-vcr6
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-1321, CWE-693
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-33883 4.0

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Record: UBUNTU-CVE-2024-33883
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVCLSA-2026-1774570929 No score

TuxCare security update for ejs (5 CVEs)

TuxCare rebuilt ejs to address 5 CVEs. Fixed in 1.0.0-tuxcare.1.

Record: CLSA-2026-1774570929
Updated: 2026-11-02

OSVCLSA-2026-1774570931 No score

TuxCare security update for ejs (2 CVEs)

TuxCare rebuilt ejs to address 2 CVEs. Fixed in 2.7.4-tuxcare.1.

Record: CLSA-2026-1774570931
Updated: 2026-11-02

OSVCLSA-2026-1780534260 No score

TuxCare security update for ejs (1 CVE)

TuxCare rebuilt ejs to address 1 CVE. Fixed in 3.1.9-tuxcare.1.

Record: CLSA-2026-1780534260
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2024-33883 No score

CVE-2024-33883 in @rootio/ejs - Patched by Root

Root has patched CVE-2024-33883 in the @rootio/ejs package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2024-33883
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`ejs` npm	before 3.1.10	3.1.10
`ejs` TuxCare:npm From an advisory covering 5 CVEs	1.0.0-tuxcare.0 up to 1.0.0-tuxcare.1, plus listed versions 1.0.0	1.0.0-tuxcare.1
`ejs` TuxCare:npm From an advisory covering 2 CVEs	2.7.4-tuxcare.0 up to 2.7.4-tuxcare.1, plus listed versions 2.7.4	2.7.4-tuxcare.1
`ejs` TuxCare:npm	3.1.9-tuxcare.0 up to 3.1.9-tuxcare.1, plus listed versions 3.1.9	3.1.9-tuxcare.1
`node-ejs` Debian:12	All versions, plus listed versions 3.1.10+~3.1.5-13.1.10+~3.1.5-23.1.8+~3.1.1-23.1.9+~3.1.5-1	None known
`node-ejs` Debian:13	before 3.1.10+~3.1.5-1	3.1.10+~3.1.5-1
`node-ejs` Debian:14	before 3.1.10+~3.1.5-1	3.1.10+~3.1.5-1
`@rootio/ejs` Root:npm	before 2.7.4-root.io.1	2.7.4-root.io.1
`ejs` Root:npm	before 2.7.4-aikido.1	2.7.4-aikido.1
`node-ejs` Ubuntu:18.04:LTS	All versions, plus listed versions 2.5.2-12.5.7-1	None known
`node-ejs` Ubuntu:20.04:LTS	All versions, plus listed versions 2.5.7-1	None known
`node-ejs` Ubuntu:22.04:LTS	All versions, plus listed versions 2.5.7-33.1.6-2	None known
`node-ejs` Ubuntu:24.04:LTS	All versions, plus listed versions 3.1.8+~3.1.1-23.1.9+~3.1.5-1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	Grantzile/PoC-CVE-2024-33883	2024-06-25

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-33883 is a medium vulnerability (CVSS 4.0) in ejs, published April 28, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in ejs 3.1.10.

References

Show 4 moreShow less