[Bug]: ts-jest includes vulnerable version of ejs (CVE-2023-29827)

[chkp-thaih]

Version

29.4.0

Steps to reproduce

Hi Maintainers,
We’ve identified that ts-jest@29.4.0 depends on ejs@^3.1.10, which is vulnerable to CVE-2023-29827.
ejs@3.1.10 is pulled as a transitive dependency and flagged as 💀 Critical.

Please consider updating the ejs dependency to >=3.1.11, which fixes the CVE.

Affected version: ts-jest@29.4.0
Suggested fix: bump ejs version, or refactor to remove dependency if no longer needed.

Thank you!

Expected behavior

Actual behavior

Debug log

Additional context

No response

Environment

-

[ahnpnl]

There is no 3.1.11 to bump too. It seems like the only way to fix is replacing with another package

[chkp-thaih]

You are right. Since there's no patched ejs version, would you consider replacing it with a safer alternative to resolve the critical CVE?

[chkp-thaih]

Thank you for addressing this-do you have an estimated timeline for when the fix will be published in the next release?

[ahnpnl]

I plan to make a release today

[dmurvihill]

Just so you know, CVE 2023-29827 is not a real vulnerability. See discussion at EJS #720.