EJS (Embedded JavaScript) is a popular templating engine that allows developers to generate dynamic HTML using JavaScript. Examining versions 0.8.8 and 0.8.6 reveals subtle but potentially important differences for developers utilizing this library. Both versions share the same core description: "Embedded JavaScript templates," and boast identical development dependencies for testing (mocha and should). The repository information and author details remain unchanged, indicating a consistent development lineage.
The primary distinction lies within the version number itself and the corresponding release date. Version 0.8.8 was released on March 24, 2014, shortly after version 0.8.6, which was released on March 21, 2014. This close proximity suggests that version 0.8.8 likely addresses bug fixes, minor improvements, or security patches identified in 0.8.6. Developers should consider upgrading to 0.8.8 to benefit from these potential enhancements.
While a detailed changelog is not provided here, the short timeframe between releases strongly implies an effort to improve stability and reliability. When choosing between the two, opting for the newer version (0.8.8) is generally recommended, unless specific compatibility issues with existing code are encountered, although this is unlikely given the incremental version jump. The "dist" field, containing the tarball URL, allows straightforward package retrieval via npm, facilitating easy updates for existing EJS users. Developers should consult the EJS project's official repository or npm page for detailed release notes to understand the precise changes included in version 0.8.8.
All the vulnerabilities related to the version 0.8.8 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
