ejs.render() function can be invoked in two ways. The first way is by calling ejs.render(template, data, options), and the second is calling ejs.render(template, data) where ejs lets the options be passed as part of the data. If used with a variable list supplied by the user (e.g. by reading it from the URI with qs or equivalent), an attacker can control ejs options, including the root option, which allows changing the project root for includes with an absolute path. As a result, the attacker can take control of the root directory for included scripts and divert it to a library under his control, thus leading to remote code execution.

Upstream patch:

https://github.com/mde/ejs/commit/3d447c5a335844b25faec04b1132dbc721f9c8f6

External References:

https://snyk.io/vuln/npm:ejs:20161128