EJS, Embedded JavaScript templates, offers a flexible way to generate HTML markup using JavaScript. Versions 2.0.4 and 2.0.5, while seemingly close, have subtle differences that may influence developers. Primarily, the key differentiator lies in their release dates. Version 2.0.4 was published just before version 2.0.5 on January 4th, 2015. Both versions sport identical dependencies and development dependencies, including jake for build tasks, mocha for testing, uglify-js for minification, and browserify for bundling.
The developer experience appears consistent across both versions, based on available data, as the core functionalities and tooling remain the same. Choosing between the two boils down to whether the very latest version, 2.0.5, is preferred for potential minor bug fixes or optimizations implemented after 2.0.4's release. The consistent dependency structure suggests a stable API, beneficial for developers seeking reliable templating without dependency conflicts. Developers can leverage EJS to write clean, maintainable templates dynamically populated with data, streamlining their web development workflow using this performant template engine.
All the vulnerabilities related to the version 2.0.5 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
