EJS (Embedded JavaScript templates) is a popular templating engine for JavaScript, enabling developers to generate dynamic HTML markup server-side or client-side. Examining versions 2.1.4 and 2.1.3, we see a very minor update between the two. Both versions share identical descriptions, dependencies, development dependencies (jake, mocha, istanbul, uglify-js, and browserify), license (Apache-2.0), repository information, and author details. The only discernible differences lie in their respective version numbers, tarball URLs, and release dates.
Version 2.1.4 was released on January 12, 2015, at 19:08:53.495Z, whereas the previous stable version, 2.1.3, was released earlier that same day at 03:10:51.503Z. The change in the tarball URL reflects the change in version number. Given the minimal difference, the update from 2.1.3 to 2.1.4 likely constitutes a patch release, potentially addressing bug fixes, very minor improvements, or security enhancements that didn't warrant a major or minor version bump.
For developers choosing which version to use, 2.1.4 is the recommended choice as it represents the latest available patch in the 2.1.x series at the time,incorporating any bug fixes made, although the functional difference with 2.1.3 would negligibly small. When including this library in your node.js project make sure you look at the latest version available to get all the newest features and updates.
All the vulnerabilities related to the version 2.1.4 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
