EJS, the popular Embedded JavaScript templating engine, saw a minor version update from 0.8.5 to 0.8.6, offering developers continued stability and reliability for dynamic web content generation. Both versions maintain the same core functionality, providing a simple way to embed JavaScript logic within HTML templates. The development dependencies, mocha for testing and should for assertions, remain consistent between the two versions, ensuring comprehensive testing capabilities during development. The core repository on GitHub remains the same, providing access to the source code and contribution opportunities. The author and contact information remain unchanged.
The primary difference lies in the release date, with version 0.8.6 being published on March 21, 2014, a few months after version 0.8.5 which was released on November 22, 2013. While the provided data doesn't explicitly detail specific bug fixes or feature additions within this minor version bump, developers can infer that 0.8.6 likely includes refinements, performance improvements, or resolutions to minor issues identified in 0.8.5. Users are encouraged to consult the commit history or release notes on the GitHub repository for detailed information about improvements. By upgrading to 0.8.6, developers benefit from the newest fixes released in the 0.8 branch of the project at the time. The tarball URLs provide direct access to the package archives for easy installation. It maintains the same features as the previous version and it should be safe to update.
All the vulnerabilities related to the version 0.8.6 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
