EJS (Embedded JavaScript templates) is a simple templating engine enabling developers to generate dynamic HTML markup with plain JavaScript. Comparing version 2.2.3 with the prior stable release, 2.2.2, reveals minimal changes from a dependency perspective. Both versions share identical development dependencies, indicating a focus on stability rather than introducing new features or third-party integrations. These dependencies include jake for build automation, mocha for testing, istanbul for code coverage analysis,uglify-js for code minification and browserify for dependency management in the browser. The core functionality and API of EJS likely remain consistent, allowing for a seamless upgrade.
The primary difference lies in the release date, with version 2.2.3 released two days after 2.2.2, pointing to potential bug fixes or minor improvements implemented in a short time span. Developers should consider this when upgrading to ensure they benefit from any addressed issues. The consistent dependency list suggests that the core focus is on the stability of the tool, and as a lightweight templating engine, updating should have little impact on existing deployments. Developers use EJS for server-side rendering or client-side templating. It is licensed using Apache-2.0.
All the vulnerabilities related to the version 2.2.3 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
