CVE-2017-1000188

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

• CWE-79

• http://www.securityfocus.com/bid/101889Third Party Advisory, VDB Entry
• https://github.com/mde/ejs/commit/49264e0037e313a0a3e033450b5c184112516d8fPatch, Third Party Advisory
• http://www.securityfocus.com/bid/101889Third Party Advisory, VDB Entry
• https://github.com/mde/ejs/commit/49264e0037e313a0a3e033450b5c184112516d8fPatch, Third Party Advisory

Published

Nov 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000182In SWFTools, a memory leak was found in wav2swf.
• CVE-2017-1000183Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-1000184Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-1000185In SWFTools, a memcpy buffer overflow was found in gif2swf.
• CVE-2017-1000186In SWFTools, a stack overflow was found in pdf2swf.
• CVE-2017-1000187In SWFTools, an address access exception was found in pdf2sw…
• CVE-2017-1000189nodejs ejs version older than 2.5.5 is vulnerable to a denia…
• CVE-2017-1000190SimpleXML (latest version 2.7.1) is vulnerable to an XXE vul…9.1
• CVE-2017-1000191Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet r…
• CVE-2017-1000192Cygnux sysPass version 2.1.7 and older is vulnerable to a Lo…
• CVE-2017-1000193October CMS build 412 is vulnerable to stored WCI (a.k.a XSS…
• CVE-2017-1000194October CMS build 412 is vulnerable to Apache configuration …