{"id":"CVE-2024-33883","aliases":["CLSA-2026-1774570929","CLSA-2026-1774570931","CLSA-2026-1780534260","DEBIAN-CVE-2024-33883","EUVD-2024-1209","GHSA-ghr5-ch3p-vcr6","ROOT-APP-NPM-CVE-2024-33883","UBUNTU-CVE-2024-33883"],"status":"published","title":"ejs lacks certain pollution protection","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00614,"percentile":0.49744,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1321","CWE-693"],"published":"2024-04-28T00:00:00Z","modified":"2026-11-02T12:02:31Z","exploits":[{"source":"pocgithub","id":"Grantzile/PoC-CVE-2024-33883","title":"Grantzile/PoC-CVE-2024-33883","date":"2024-06-25","url":"https://github.com/Grantzile/PoC-CVE-2024-33883"}],"fixes":[{"ecosystem":"npm","package":"ejs","fixed_in":["3.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"ejs","fixed_in":["3.1.9-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-ejs","fixed_in":["3.1.10+~3.1.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-ejs","fixed_in":["3.1.10+~3.1.5-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/ejs","fixed_in":["2.7.4-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"ejs","fixed_in":["2.7.4-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-tuxcare.0"},{"fixed":"1.0.0-tuxcare.1"}]}],"versions":["1.0.0"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.4-tuxcare.0"},{"fixed":"2.7.4-tuxcare.1"}]}],"versions":["2.7.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.9-tuxcare.0"},{"fixed":"3.1.9-tuxcare.1"}]}],"versions":["3.1.9"]},{"source":"osv","ecosystem":"Debian:12","package":"node-ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.10+~3.1.5-1","3.1.10+~3.1.5-2","3.1.8+~3.1.1-2","3.1.9+~3.1.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10+~3.1.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10+~3.1.5-1"}]}]},{"source":"osv","ecosystem":"npm","package":"ejs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.10"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.2-1","2.5.7-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.7-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.7-3","3.1.6-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.8+~3.1.1-2","3.1.9+~3.1.5-1"]}],"references":[{"url":"https://github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5","tags":["x_transferred","fix","web","report"]},{"url":"https://github.com/mde/ejs/compare/v3.1.9...v3.1.10","tags":["x_transferred","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240605-0003/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33883","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240605-0003","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ghr5-ch3p-vcr6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33883.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-33883","tags":["advisory"]},{"url":"https://github.com/mde/ejs","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-33883","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-33883","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-33883","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","status":"published","published":"2024-04-28T00:00:00Z","modified":"2024-08-02T02:42:59.934Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:34:21.784174Z"}],"euvd":[{"id":"EUVD-2024-1209","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","status":"published","published":"2024-04-28T00:00:00Z","modified":"2024-08-02T02:42:59Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:21.908049Z"}],"ghsa":[{"id":"GHSA-ghr5-ch3p-vcr6","title":"ejs lacks certain pollution protection","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","status":"published","published":"2024-04-28T18:30:31Z","modified":"2024-08-02T15:45:54Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-693","CWE-1321"],"updated_at":"2026-11-02T14:37:57.422393Z"}],"nvd":[{"id":"CVE-2024-33883","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","status":"published","published":"2024-04-28T16:15:23.233Z","modified":"2026-06-17T07:32:30.38Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:09:55.124919Z"}],"osv":[{"id":"CVE-2024-33883","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","status":"published","published":"2024-04-28T00:00:00Z","modified":"2026-10-28T02:30:22.282960291Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-33883","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","status":"published","published":"2024-04-28T16:15:23.233Z","modified":"2026-11-02T12:02:31.653554447Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-ghr5-ch3p-vcr6","title":"ejs lacks certain pollution protection","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","status":"published","published":"2024-04-28T18:30:31Z","modified":"2026-09-10T03:50:11.217600593Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321","CWE-693"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"UBUNTU-CVE-2024-33883","description":"The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.","status":"published","published":"2024-04-28T16:15:00Z","modified":"2025-10-24T05:09:11Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"CLSA-2026-1774570929","title":"TuxCare security update for ejs (5 CVEs)","description":"TuxCare rebuilt ejs to address 5 CVEs. Fixed in 1.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:03.661053163Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774570931","title":"TuxCare security update for ejs (2 CVEs)","description":"TuxCare rebuilt ejs to address 2 CVEs. Fixed in 2.7.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:05.276193584Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1780534260","title":"TuxCare security update for ejs (1 CVE)","description":"TuxCare rebuilt ejs to address 1 CVE. Fixed in 3.1.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.400124529Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"ROOT-APP-NPM-CVE-2024-33883","title":"CVE-2024-33883 in @rootio/ejs - Patched by Root","description":"Root has patched CVE-2024-33883 in the @rootio/ejs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-16T06:14:01Z","modified":"2026-07-16T13:00:14.638005262Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}