EJS (Embedded JavaScript) offers a straightforward way to embed JavaScript directly within HTML to create dynamic templates, ideal for generating web pages with variable data. Reviewing the changes in EJS from version 2.4.2 to 2.5.1 reveals a focus on development tooling and dependency updates, impacting primarily the development workflow rather than core functionality. The core functionality of being able to embed javascript templates didn't suffer changes.
Specifically, notable updates in the newer version include upgrades to key development dependencies. JSDoc, used for generating API documentation, jumps from version 3.3.0-beta1 to 3.4.0. ESLint, a JavaScript linter for code quality, is bumped from an unlisted version to 3.0.0., and Istanbul, a code coverage tool, is updated from version ~0.3.5 to ~0.4.3.
Furthermore, Lru-cache, is a popular library, sees a significant upgrade from version 2.5.0 to 4.0.1. Further minor upgrades are also present, to the browserify and uglify-js libraries.
For developers using EJS, these changes translate into improved documentation, enhanced code quality checks, more accurate code coverage reporting, and more efficient caching which are all directed at enabling more stable and modern development practices. While the core templating functionality remains consistent, the updated toolchain provides a better overall developer experience, particularly during development and testing phases. The license remains Apache-2.0 in both versions, offering permissive use.
All the vulnerabilities related to the version 2.5.1 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
