EJS (Embedded JavaScript templates) is a simple templating language that lets you generate HTML markup with plain JavaScript. Comparing versions 2.0.2 and 1.0.0 reveals significant changes for developers. Version 2.0.2 boasts enhanced tooling, indicating a shift towards a more robust development workflow. Specifically, it introduces jake for build automation, uglify-js for minification, and browserify for bundling – essential for modern JavaScript projects aiming for optimized performance. This contrasts sharply with version 1.0.0, which only lists mocha and should for testing purposes, suggesting a simpler, less automated development setup.
Another key difference lies in the project's maintainership. Version 1.0.0 credits TJ Holowaychuk as the author, while version 2.0.2 attributes authorship to Matthew Eernisse, signaling a change in project leadership and potentially different development philosophies. The repository URL also reflects this change. While both versions share the same core description, the evolution in development dependencies and maintainership highlights a maturation of the EJS library. Developers choosing between these versions should consider their project's complexity and requirements. Version 2.0.2's focus on modern build tools makes it a compelling choice for larger, more demanding projects, while version 1.0.0 might suffice for simpler use cases. The introduction of minification and bundling in the newer version also directly impacts performance, potentially leading to faster load times for web applications.
All the vulnerabilities related to the version 2.0.2 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
