EJS (Embedded JavaScript templates) is a popular templating engine for JavaScript, utilized in both server-side (Node.js) and client-side environments. Versions 2.3.1 and 2.3.2 share core characteristics: they both facilitate dynamic HTML generation by embedding JavaScript code within HTML templates. Key features remain consistent, including dependency-free operation (no runtime dependencies), support for various template delimiters, and inclusion of utilities for escaping HTML. Development dependencies consist of tools like Jake for build automation, JSDoc for documentation generation, Mocha for testing, Rimraf for file removal, Istanbul for code coverage, lru-cache for caching, Uglify-JS for minification, and Browserify for bundling.
The primary difference lies in the release date and potentially internal bug fixes or minor enhancements that aren't explicitly detailed within the limited metadata provided. Version 2.3.1 came out in February 2015, while 2.3.2 was released in June 2015. Developers choosing between these versions would likely opt for the newer 2.3.2, assuming it addresses any identified issues present in 2.3.1. For developers new to EJS, both versions offer a straightforward way to create dynamic web content. They benefit from the Apache-2.0 license, allowing for free use in commercial projects. The project is actively maintained on GitHub, ensuring community support and ongoing development. Using EJS, a developer can easily combine the best of javascript code with html.
All the vulnerabilities related to the version 2.3.2 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
