EJS (Embedded JavaScript Templates) offers a straightforward way to embed JavaScript logic within HTML templates, making it a popular choice for dynamic content generation in web applications. Comparing version 2.1.1 with the prior stable release, 2.0.8, reveals subtle but important changes impacting developer workflows. While both versions share the same core functionality and maintain identical dependencies, notably leveraging tools like Uglify-js and Browserify for minification and module bundling, and Jake for build tasks, a crucial distinction lies in thedevDependencies.
Version 2.1.1 specifies precise versions for development dependencies like Jake (^8.0.0), Mocha (^2.1.0), Istanbul (~0.3.5), Uglify-js (^2.4.16) and Browserify (^8.0.3), ensuring a consistent and predictable development environment. Conversely, version 2.0.8 employs a more relaxed version constraint for Jake (8.0.x), allowing for potentially breaking changes within minor or patch releases. This tighter control in version 2.1.1 minimizes the risk of unexpected build failures or compatibility issues arising from dependency updates. Furthermore, while Istanbul is not present in the devDependencies of the 2.0.8 version, it's present in the 2.1.1, showing that it's a new addition to the toolchain. This highlights the library's commitment to thorough testing and code quality. For developers prioritizing stability and reproducible builds, version 2.1.1 provides a more reliable foundation. Both versions are licensed under Apache-2.0, granting broad usage rights.
All the vulnerabilities related to the version 2.1.1 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
