EJS (Embedded JavaScript templates) offers a straightforward way to generate dynamic HTML in Node.js and the browser. Comparing versions 2.2.2 and 2.2.1 reveals subtle differences, primarily in their release dates. Version 2.2.2 was released on January 21, 2015, while version 2.2.1 arrived a day earlier, on January 20, 2015. Both share identical descriptions, dependencies (none), and development dependencies, which include tools like Jake for build automation, Mocha for testing, Istanbul for code coverage, Uglify-js for minification, and Browserify for bundling. The license remains Apache-2.0 in both versions, and they both point to the same GitHub repository and author information.
The core functionality and intended use for developers remain consistent between these two releases. EJS excels in situations where you need to inject data into HTML templates, simplifying the creation of dynamic web pages or emails. Developers can appreciate the library's lean footprint, as reflected by the absence of runtime dependencies, keeping projects lightweight. Its reliance on familiar development tools ensures compatibility with existing workflows. While the update from 2.2.1 to 2.2.2 appears minor, checking the changelog accompanying the releases is advisable for potentially critical bug fixes or very specific edge case behaviors that might influence integration in particular complex projects.
All the vulnerabilities related to the version 2.2.2 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
