EJS (Embedded JavaScript) is a simple templating language that lets you generate HTML markup with plain JavaScript. Versions 2.0.3 and 2.0.4 share identical dependencies and developer tools like Jake for build tasks, Mocha for testing, Uglify-js for minification, and Browserify for bundling. Both point to the same repository on GitHub and are authored by Matthew Eernisse.
The primary observable difference lies in their release dates. Version 2.0.3 was published on January 4th, 2015 at 18:50 UTC, while version 2.0.4 followed later the same day, at 23:19 UTC. This indicates that version 2.0.4 likely contains bug fixes or very minor enhancements over its predecessor.
For developers already using EJS, upgrading from 2.0.3 to 2.0.4 is likely a low-risk operation offering potential stability improvements. A simple npm install ejs@latest will get you the newest stable release. The absence of changes in dependencies suggests that existing projects are unlikely to experience compatibility issues. While the specific changes are not detailed in the provided metadata, the rapid succession suggests a fix addressing an immediate need. Developers new to EJS can confidently choose either version as a starting point, understanding that the more recent 2.0.4 is the slightly updated version. Always refer to the project's changelog or commit history on GitHub for detailed information about the specific changes introduced between these versions.
All the vulnerabilities related to the version 2.0.4 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
