Advisories for Npm/Ejs package

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

This advisory has been marked as a false positive. See https://github.com/mde/ejs/issues/720#issuecomment-1587399501

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

The ejs module is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile().

The ejs module is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function.

The ejs module is vulnerable to a Cross-site-scripting in ejs.renderFile().