EJS (Embedded JavaScript Templates) is a simple templating language that lets you generate HTML markup with plain JavaScript. Versions 2.0.6 and 2.0.7 are very similar, sharing identical dependencies and development dependencies, including tools like jake for build tasks, mocha for testing, uglify-js for minification, and browserify for bundling. They are both authored by Matthew Eernisse and hosted on GitHub.
The primary distinction between the two versions lies in their release dates. Version 2.0.6 was released on January 5th, 2015, at 00:45:02 UTC, while version 2.0.7 was released later on the same day at 20:52:20 UTC. This suggests that version 2.0.7 likely contains bug fixes or minor improvements implemented after the 2.0.6 release. While the specific changes aren't detailed in the provided data, developers should generally opt for the newer version (2.0.7) to benefit from any potential patches or refinements. Both versions are available as gzipped tarballs for easy installation via npm or other package managers. If you are already using EJS consider upgrading.
All the vulnerabilities related to the version 2.0.7 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
