CVE-2023-29827

CVE-2023-29827 describes a critical server-side template injection vulnerability in EJS v3.1.9, where an attacker can achieve template injection by manipulating the closeDelimiter parameter if the EJS file is controllable. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While the vendor disputes its classification as a vulnerability when used with untrusted input, its high EPSS score and FAUCET Risk Score indicate significant potential risk; however, there is currently no evidence of active exploitation, public exploit code (beyond Nuclei templates), or significant community discussion.