Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mde/ejs

              main @ 2c41365
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Prototype Pollution: 2 prior fixes. Scrutinize any change in this area.

lib/ejs.js: most-fixed (4 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Attackers can inject arbitrary JavaScript commands during template compilation by manipulating EJS options (such as outputFunctionName, localsName, and destructuredLocals) that are concatenated directly into the template function body. This has been exploited in the wild via CVE-2022-29078.

Prototype Pollution: Attackers can pollute Object.prototype to inject malicious configuration options into the template compilation context, leading to downstream security bypasses and code execution when internal options are parsed.

Reflected XSS: Unsanitized properties, such as the template filename, can be appended to runtime source directives like sourceURL, leading to script injection or reflected cross-site scripting.