Potential security vulnerabilities in ejs #280
Description
We are using the project as a dependency in our project.
The dependency graph on github shows us the following security warning:
Moderate severity: CVE-2017-1000188
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
See mde/ejs@49264e0
High severity: CVE-2017-1000228
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
See https://snyk.io/vuln/npm:ejs:20161128
package-lock.json update suggested:
ejs ~> 2.5.5