title: Known moderate severity security vulnerability detected in ejs < 2.5.5
body: <p>I got this alert for a few projects on GitHub:</p>
  
  <blockquote>
    <p>We found a potential security vulnerability in one of the dependencies
    used by a repository that you contribute to.</p>
    
    <p>Known moderate severity security vulnerability detected in ejs &lt; 2.5.5
    defined in package.json. package.json update suggested: ejs ~> 2.5.5.</p>
  </blockquote>
  
  <p>I can get rid of the warning by making the recommended update in <code>package.json</code>, and a <code>npm update</code> seems to work without problems. But I am a little bit reluctant to begin messing with the production servers. </p>
  
  <p>The vulnerability is <strong><a href="https://nvd.nist.gov/vuln/detail/CVE-2017-1000188" rel="nofollow noreferrer">https://nvd.nist.gov/vuln/detail/CVE-2017-1000188</a></strong> created 11.16.2017. In the alerted projects <code>ejs</code> is used by <code>express</code> and <code>express</code> is only used along with <code>sequelize</code>.</p>
  
  <p>Does any one have insight about this vulnerability? How would XSS be possible in a scenario where <code>ejs</code> is used static and internally by <code>express</code>? Are there any real use case where <code>ejs</code> -> <code>express</code> -> <code>sequelize</code> can be vulnerable to a XSS attack? </p>