CVE-2022-29078:ejs: Server-side template injection / code injection , ref.
A reconstruction of the flaw, and the evidence path Lachesis follows to make it visible.
Attacker-influenced render options (e.g. outputFunctionName) reach ejs template compilation as code.
That is the shape of the failure. The rest of this case file follows the evidence behind it.
What was known.
What Lachesis established.
Known before Lachesis ran
The CVE and vulnerable release were selected from public history. We are not claiming novel discovery.
- CVE
- CVE-2022-29078
- Vulnerable target
- v3.1.6 (affected: < 3.1.7) · vulnerable
- Prior knowledge
- CVE-2022-29078 · v3.1.6 (affected: < 3.1.7) is vulnerable
Independent re-detection
The experiment graph was built around the vulnerable ejs library tree at release v3.1.6 (lib scope), rather than starting from arbitrary source. We did not point the tool at the CVE. Enumeration ran over the whole candidate registry (default registry spans every family) with the pass-3 ranker ordering leads; the injection family surfaced on its own alongside the lifecycle, navigation, object-integrity and resource families, and 12 injection.exec.escaping candidates fired across lib/ejs.js -- including the template compile entrypoints (exports.compile @379, exports.render @413) and the two `new Function(...)` constructors (@107, @648) that assemble and execute the generated template function. The top-ranked capsule anchored on a RegExp.prototype.exec call in getIncludePath (line 158), a catalogued injection.exec sink that is a look-alike, not the SSTI itself. Every field under sast_output is the enumerator's own emission (candidate capsule plus sources_of value-flow cone); everything under adjudication is my reading of the source and fix and is labelled as such.
- Seeded inputs
- None
- Run timestamp
- 2026-09-02T13:32:54Z
- Evidence artifact
- ejs-3.1.6.kuzu
The commands and outputs below come from this recorded Lachesis run.
What Lachesis reconstructed.
One historical repository. Four captured queries. A complete source-to-sink argument.
Lachesis follows the same evidence path through unfamiliar repositories.
Here is how the path becomes visible.
These are the recorded questions Lachesis asked of the historical vulnerable code, followed by the raw result and source location each query returned.
Captured runThis is a real replay of Lachesis over the graph built for this case from ejs v3.1.6 (lib scope). Every command below was run against that graph and every result is captured on that drive. We did not point the tool at a file or a family. The hunt listed the whole taxonomy first and the injection family came out of that (12 injection.exec.escaping candidates out of 428). No request or payload was seeded; the graph was built from source alone and the injection leads were discovered from graph structure, so the mode is independent-redetection. Elapsed 5.7s.
Load the graph and list every bug family
First we load the graph and enumerate blind over the whole taxonomy, with no family chosen ahead of time. 428 candidates come back across the domains; injection.exec.escaping is one family among lifecycle, navigation, object-integrity, resource and filesystem.
graph loaded (1156 nodes, 3371 edges, typescript-compiler-api frontend); taxonomy enumerable across all domains; 428 candidates enumerated blind.A small line with a large consequence.
no validation that outputFunctionName / localsName / destructuredLocals are valid JS identifiers before they are concatenated into compiled code.
if (opts.outputFunctionName) {
prepended += ' var ' + opts.outputFunctionName + ' = __append;' + '\n';
}// validate each option name against /^[a-zA-Z_$][0-9a-zA-Z_$]*$/ and throw otherwise (fixed in 3.1.7, commit 15ee6985).
The original record.
Read the historical advisory and vulnerability record behind this reconstruction.