soos-io / sample-project-python Goto Github PK

Summary:

A Critical severity Vulnerability was detected in image-resizer at Jan 27, 2023, 10:37 AM.

CVE-2022-29078 Vulnerability

Description:

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Solution:

Remove or update the package(s) and version(s) which are causing this vulnerability.

Fix:

Update the package 'ejs', to one of the suggested versions.

npm install [email protected]