EJS (Embedded JavaScript templates) provides a way to generate dynamic HTML content on the server-side or client-side. Comparing versions 2.0.6 and 2.0.5, the core functionality remains consistent: rendering templates using JavaScript. Both versions share the same dependencies and development dependencies, including Jake for build tasks, Mocha for testing, UglifyJS for minification, and Browserify for bundling, ensuring a stable development environment. The repository URL and author information are also identical, indicating continuity in the project's maintenance.
The primary difference between these versions lies in their release dates. Version 2.0.6 was released on January 5, 2015, shortly after version 2.0.5, released on January 4, 2015. This suggests that version 2.0.6 likely includes bug fixes or minor improvements implemented shortly after the previous release. For developers, upgrading from 2.0.5 to 2.0.6 is recommended to benefit from these potential refinements and ensure the most stable experience. Both versions are available via npm, making integration into existing projects straightforward via standard npm install commands. Both also are lightweight with no production dependencies. Given how close the release dates are a detailed changelog should be consulted alongside upgrading.
All the vulnerabilities related to the version 2.0.6 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
