EJS, or Embedded JavaScript templates, is a popular templating engine that lets developers generate dynamic HTML markup with plain JavaScript. Comparing versions 2.3.4 and 2.3.3 reveals minimal core changes, with both retaining identical dependencies and development dependencies such as jake, jsdoc, mocha, rimraf, istanbul, lru-cache, uglify-js, and browserify, necessary for building, testing, and optimizing the library. Both versions operate under the Apache-2.0 license and hail from the same Git repository maintained by Matthew Eernisse.
The primary distinguishing factor lies in their release dates. Version 2.3.4 was published on September 7, 2015, while version 2.3.3 saw daylight on July 11, 2015. The differences between the two releases are likely bug fixes, minor improvements, or security patches. Given the lack of specific changelog information in the provided data, developers should consult the official EJS repository or release notes to understand the exact nature of the changes.
For developers considering EJS, both versions offer a reliable and flexible way to embed JavaScript directly into HTML, enabling dynamic content generation. Given the potential for bug fixes and security enhancements, opting for the newer version (2.3.4) is generally recommended. However, those already using 2.3.3 should evaluate the specific fixes and features introduced in 2.3.4 against their project's needs to determine if an upgrade is necessary.
All the vulnerabilities related to the version 2.3.4 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
