EJS (Embedded JavaScript templates) version 2.3.1 represents an iteration upon the prior stable release, version 2.2.4, offering developers refinements and potential enhancements for templating in JavaScript environments. Both versions share the core function of enabling dynamic content generation within web applications and Node.js projects using a simple and flexible templating syntax. Key similarities include relying on common development dependencies such as Jake for build tasks, Mocha for testing, Istanbul for code coverage, Uglify-js for minification and Browserify for bundling which ensures developers can use the same workflows across versions. They are both licensed under Apache-2.0.
The primary difference lies in the introduction of new development dependencies like jsdoc and lru-cache, which suggests a focus on improved documentation, potentially leading to better understanding and usage of the library while the lru-cache integration should optimize template caching mechanisms, leading to potential performance gains in applications rendering numerous templates. While both versions share the same author and repository, the updated release date indicates a more recent build with potential bug fixes or minor enhancements that address issues reported by the community or discovered through internal testing. Developers considering an upgrade should assess the impact on their existing projects, particularly if they rely on specific undocumented behaviors or custom extensions. Checking the changelog or release notes associated with version 2.3.1 is recommended to fully understand the scope of changes and any potential compatibility considerations.
All the vulnerabilities related to the version 2.3.1 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
