EJS (Embedded JavaScript) is a simple templating engine that lets you generate HTML markup with plain JavaScript, useful for creating dynamic web pages and applications. Examining versions 2.1.3 and 2.1.2, the core functionality remains the same, indicated by an identical set of dependencies and devDependencies. Both versions rely on tools like jake for build automation, mocha for testing, istanbul for code coverage analysis, uglify-js for minification and browserify for bundling to be used in the browser. This suggests that the development workflow and intended usage remain consistent between the two.
The only observable difference lies in the version number, and their respective releaseDate. Version 2.1.3 was released on January 12, 2015, shortly after version 2.1.2's release on January 11, 2015. This points towards a very minor update, possibly a quick bug fix or a tiny performance tweak. For developers, this near-simultaneous release suggests that upgrading from 2.1.2 to 2.1.3 would likely be a low-risk endeavor. The library's strong reliance on common development tools makes integration predictable for new and existing users. If you are using EJS and have a version prior these updates, upgrading is recommended to ensure you are using the latest improvements and bug fixes.
All the vulnerabilities related to the version 2.1.3 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
