EJS (Embedded JavaScript) is a simple templating engine that lets you generate HTML markup with plain JavaScript. Examining versions 2.4.1 and 2.3.4 reveals incremental updates rather than a wholesale revamp, maintaining a consistent developer experience. Both versions share the same core set of devDependencies used for building, testing, and documentation, featuring tools like Jake for build automation, JSDoc for API documentation, Mocha for testing, Rimraf for file deletion, Istanbul for code coverage, lru-cache for caching, UglifyJS for minification, and Browserify for bundling. This indicates a commitment to consistent development practices around the library.
The key difference lies in the version and releaseDate. Version 2.4.1 was released on January 24, 2016, while version 2.3.4 came out on September 7, 2015. This suggests a period of roughly four and a half months between releases. The update from 2.3.4 to 2.4.1 likely incorporates bug fixes, performance enhancements, or minor feature additions. While the metadata doesn't provide specifics, developers upgrading should anticipate improvements to stability or efficiency. Since the dependencies listed remain identical, breaking changes are unlikely. For developers already using EJS, upgrading from 2.3.4 to 2.4.1 should be a relatively straightforward move that is worth the effort to have the latest bug fixes. New project? You can always use the latest version of the library: it's stable and it gets the job done, so go for it!
All the vulnerabilities related to the version 2.4.1 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
