Submit Feedback
Legacy Knowledge Base
Published Jun. 30, 2025

Vulnerability issues related to the EJS version in Fragments Toolkit

Written By

Madhusudan Sharma

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • Vulnerability issues (ejs template injection vulnerability) were reported related to the EJS version inside the yarn.lock file while building fragments using the fragments toolkit.
  • The EJS version is below 3.1.9 in many places in this yarn.lock file.

Environment

  • Liferay DXP 7.4

Resolution

  • The fragment toolkit is going to be deprecated (as per the roadmap) and instead of having a separate tool for fragments, this functionality will be unified with other tools in the portal.
  • Regarding the EJS vulnerability, the EJS library only runs when generating new files in the developer's (eg. running yarn run add-fragment) computer, the code generated by each template can (and should) be reviewed and updated by the developer, so no harmful code should reach the portal at any time. Therefore, the only viable fix for this concern would be to review the code and ensure that no harmful code reaches the portal.

    Please note that the fragment toolkit is only used to generate boilerplate code and it should be fine to submit code to the portal as long as it is being reviewed by a developer.

  • Furthermore, the following are some suggestions that might be helpful in preventing any EJS vulnerability issues (inside fragments toolkit):
    1. Do not develop fragments in the same production machine where the portal is published but in another development environment. The same must be followed even with updated dependencies.
    2. In case you have some security policy against all of this (which could be reasonable), then it is suggested to develop the fragments on an external machine and import them using the UI, either with zip files or by copy-pasting the code in the fragment administration.

Additional Information

Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?