EJS (Embedded JavaScript) is a simple templating engine that lets you generate HTML markup with plain JavaScript. Versions 2.0.2 and 2.0.3 share identical core functionality, targeting developers who need a flexible way to inject dynamic content into web pages or other text-based formats. Both versions boast zero runtime dependencies, making them lightweight and easy to integrate into projects using Node.js or browser environments. Developers can leverage familiar JavaScript syntax within EJS templates for control flow, variable interpolation, and custom logic.
The key difference between the two versions lies in their release dates. Version 2.0.3 was published on January 4, 2015, at 18:50:30 GMT, while version 2.0.2 appeared earlier the same day at 07:05:30 GMT. This suggests that version 2.0.3 likely addresses minor bug fixes, documentation updates, or other very small improvements implemented shortly after the release of 2.0.2. Given the identical dependency and development dependency lists, no feature changes can be expected between both versions.
For those starting a new project, it's always recommended to use the latest stable version; version 2.0.3 would be the preferable choice, as it contains the most up-to-date refinements, however, both versions should behave very similarly. Both versions rely on development tools like Jake for builds, Mocha for testing, UglifyJS for Javascript minification and Browserify for bundling.
All the vulnerabilities related to the version 2.0.3 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
