Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
10/ There's a failure benchmarks can't easily distinguish: generation failure independent of reasoning. GPT-5.2 scores 0% on Jenkins CVE-2022-29078 even at full-info - it localised the bug correctly every time but produced syntactically broken patches.
Post summary
The text reports that GPT-5.2 cannot generate valid patches for Jenkins CVE-2022-29078, but provides no exploit, patch, or detailed technical information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ejs | ejs | 3.1.6 | node.js | - |