EJS, Embedded JavaScript templates, offers developers a straightforward way to generate dynamic HTML content from JavaScript. Comparing versions 1.0.0 and the older 0.8.8 reveals subtle yet potentially impactful differences. Both share the same core functionality and developer details, being authored by TJ Holowaychuk and maintaining the same repository. Crucially, both versions list "mocha" and "should" as development dependencies, indicating a focus on testing and code quality.
The primary difference lies in their version numbers and release dates. Version 1.0.0 arrived shortly after 0.8.8, both being released on March 24, 2014, suggesting a rapid iteration or a quick fix. Upgrading to 1.0.0 likely includes minor bug fixes, performance enhancements, or perhaps adherence to newer coding standards. While the core usage remains consistent, developers should always review the release notes (if available) for a detailed breakdown of changes including breaking changes to ensure compatibility with their existing projects. Consider looking at the changelogs in the project repository. For new projects, 1.0.0 is the better starting point to be on track with the newer features.
All the vulnerabilities related to the version 1.0.0 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
