The ejs (aka Embedded JavaScript templates) package prior to 3.1.10 for Node.js lacks certain pollution protection.