CVE-2017-1000228

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

• CWE-20

• http://www.securityfocus.com/bid/101897Third Party Advisory, VDB Entry
• https://snyk.io/vuln/npm:ejs:20161128Exploit, Technical Description, Third Party Advisory
• http://www.securityfocus.com/bid/101897Third Party Advisory, VDB Entry
• https://snyk.io/vuln/npm:ejs:20161128Exploit, Technical Description, Third Party Advisory

Published

Nov 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000222Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-1000223A stored web content injection vulnerability (WCI, a.k.a XSS…
• CVE-2017-1000224CSRF in YouTube (WordPress plugin) could allow unauthenticat…
• CVE-2017-1000225Reflected XSS in Relevanssi Premium version 1.14.8 when usin…
• CVE-2017-1000226Stop User Enumeration 1.3.8 allows user enumeration via the …
• CVE-2017-1000227Stored XSS in Salutation Responsive WordPress + BuddyPress T…
• CVE-2017-1000229Integer overflow bug in function minitiff_read_info() of opt…
• CVE-2017-1000230The Snap7 Server version 1.4.1 can be crashed when the ItemC…
• CVE-2017-1000231A double-free vulnerability in parse.c in ldns 1.7.0 have un…
• CVE-2017-1000232A double-free vulnerability in str2host.c in ldns 1.7.0 have…
• CVE-2017-1000233Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-1000234I, Librarian version <=4.6 & 4.7 is vulnerable to Directory …5.3