{"cvss":9.8,"datePublished":"2026-09-18T00:00:00Z","dateUpdated":"2026-09-18T00:00:00Z","description":"ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.","dueDate":"","id":"CVE-2023-29827","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"ejs","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"ejs ejs Improper Neutralization of Special Elements in Output Used by a Downstream Component","vendor":"ejs"}