CVE-2024-33883

What it actually does

EJS versions before 3.1.10 lack sufficient protections against prototype-pollution-style input in objects supplied to template rendering or option handling. If an application allows untrusted keys to reach EJS data or configuration objects, specially named properties such as prototype-related keys can influence inherited object behavior during rendering. The published severity and vector indicate a low availability impact, with no indicated confidentiality or integrity impact and no known mature public exploitation in the provided data.

Why it matters to the business

Affected applications may become unstable or experience rendering failures if attacker-controlled input reaches EJS template processing. The risk is lower than a remote code execution issue, EPSS is low, the issue is not in CISA KEV, and no ransomware association is indicated, but EJS is commonly embedded in Node.js web applications and should be upgraded as part of dependency hygiene because the issue has been public since April 2024.

How an attack unfolds

An attacker first identifies an application that uses vulnerable EJS versions and accepts user-controlled structured input, query parameters, JSON bodies, template data, or configuration-like objects. The attacker then submits keys associated with prototype pollution, such as __proto__, constructor, or prototype-derived property paths, in a location that the application merges or passes into EJS rendering. If the application does not sanitize these keys and the vulnerable EJS code consumes the polluted object, inherited properties may affect template rendering behavior. The expected impact for this CVE is disruption or failure of rendering logic, causing partial application denial of service rather than confirmed data theft or code execution.

How to fix it

Upgrade EJS to version 3.1.10 or later. For source-based consumers of mde/ejs, ensure the code includes commit e469741dca7df2eb400199e1cdb74621e3f89aa5 or a later fixed revision. Regenerate lockfiles after updating, redeploy rebuilt artifacts, and verify that transitive dependencies do not reintroduce an older EJS version. As defense in depth, reject or strip dangerous object keys such as __proto__, prototype, and constructor from untrusted input; avoid unsafe deep-merge behavior on user-controlled objects; create option/data objects with null prototypes where appropriate; and ensure template rendering errors are handled without crashing the process.

How to confirm the fix worked

Confirm all deployed applications resolve EJS to 3.1.10 or later by checking package manifests and lockfiles with commands such as npm ls ejs, npm audit, yarn why ejs, or pnpm why ejs. Inspect built containers and serverless bundles for node_modules/ejs/package.json and verify the version. For Git-sourced usage, confirm the deployed revision includes e469741dca7df2eb400199e1cdb74621e3f89aa5 or later. Perform a negative test against non-production instances by submitting benign prototype-pollution-style keys to relevant endpoints and confirm they are rejected, stripped, or do not affect rendering behavior. Monitor application logs after deployment for a reduction in EJS rendering errors or crashes.

Typical attack path

1. Fingerprint a Node.js application or dependency bundle that uses EJS before 3.1.10.
2. Find an input path where user-controlled object keys are accepted, parsed, merged, and passed to EJS rendering or render options.
3. Submit prototype-pollution-style keys such as __proto__, constructor, or prototype in query strings, form fields, or JSON bodies.
4. Trigger a route or function that renders an EJS template using the polluted data or options object.
5. Cause rendering errors, application instability, or denial-of-service conditions depending on how the application handles template failures.

How to detect it

To determine whether this was already exploited, review HTTP access logs, WAF logs, API gateway logs, application request logs, and Node.js application error logs for prototype-pollution-style payloads followed by EJS rendering failures, elevated 500 responses, process restarts, or container health-check failures. Focus on requests containing keys or encoded forms of __proto__, constructor, prototype, constructor.prototype, or nested bracket/dot notation used to alter object prototypes. Correlate suspicious requests with stack traces involving ejs, render, compile, Template, or node_modules/ejs. Also examine process manager logs such as PM2, systemd, Kubernetes events, container runtime logs, and serverless invocation logs for crashes or repeated restarts immediately after suspicious requests. Because no mature exploit or KEV activity is indicated in the provided data, absence of these artifacts is meaningful but not definitive; rely on dependency validation to confirm exposure has been removed.

• __proto__
• %5F%5Fproto%5F%5F
• constructor.prototype
• constructor[prototype]
• constructor%5Bprototype%5D
• prototype[
• %5B__proto__%5D
• node_modules/ejs
• node_modules/ejs/package.json
• Error: ejs
• at Object.compile
• at exports.render
• at exports.renderFile
• node_modules/ejs/lib/ejs.js

What your security team should do

• Inventory Node.js applications and repositories that directly or transitively include EJS.
• Prioritize upgrading internet-facing or user-input-heavy applications to EJS 3.1.10 or later, even though EPSS and known exploitation signals are low.
• Add software composition analysis checks to block EJS versions before 3.1.10 in CI/CD pipelines.
• Review request parsing, object merging, and template rendering code paths for untrusted keys reaching EJS data or options.
• Add centralized input filtering for prototype-pollution keys and alert on attempts containing __proto__, constructor.prototype, or prototype mutation patterns.
• Search recent web, API gateway, and application logs for prototype-pollution payloads and correlated EJS render errors or Node.js process crashes.
• Ensure process supervisors, container health checks, and error handling prevent repeated template failures from causing prolonged service outages.