EJS (Embedded JavaScript templates) version 2.2.1 is a minor update following version 2.1.4, both maintained under the Apache-2.0 license and authored by Matthew Eernisse. Primarily, the core functionality (Embedded JavaScript templates) remains consistent, indicated by the shared description. Both versions share identical dependency and development dependency structures, relying on tools like Jake for build automation, Mocha for testing, Istanbul for code coverage, Uglify-js for minification, and Browserify for bundling, suggesting that the update focused on improvements rather than feature additions or dependency upgrades. A notable difference is the release date; version 2.2.1 was released on January 20, 2015, succeeding version 2.1.4, which was released on January 12, 2015. This short interval between releases hints at a swift response to bugs discovered or minor enhancements implemented shortly after the 2.1.4 release. For developers, this suggests a stable library supported by consistent maintenance. Users can expect similar performance and integration with the same development workflow. The focus on maintained, older versions like this ensures compatibility with a wide range of environments and projects. As both versions utilize the same structure, the update should be a seamless transition. The package is available through npm and accessible via the provided tarball URLs.
All the vulnerabilities related to the version 2.2.1 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
