CVE-2022-29078
Published: 25 April 2022
Summary
CVE-2022-29078 is a critical-severity Code Injection (CWE-94) vulnerability in Ejs Ejs. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a server-side template injection flaw in the ejs (Embedded JavaScript templates) package version 3.1.6 for Node.js. It arises because the settings[view options][outputFunctionName] parameter is parsed as an internal option and can be overwritten with an arbitrary operating system command that executes during template compilation. The issue is tracked as CVE-2022-29078 with a CVSS score of 9.8 and is classified under CWE-94.
An unauthenticated remote attacker can supply a malicious value for the affected setting when the application renders templates. Successful exploitation grants arbitrary command execution on the underlying operating system, resulting in full confidentiality, integrity, and availability impact.
Public references point to the ejs GitHub releases and a NetApp security advisory that address the issue through updated package versions. The current and peak EPSS score of 0.9346 reflects sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1801
Vulnerability details
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.