EJS (Embedded JavaScript templates) offers a streamlined way to generate dynamic HTML within Node.js and the browser. Comparing versions 2.5.1 and 2.5.2 reveals subtle but potentially impactful changes for developers. Both versions share the same core set of development dependencies, including tools like Jake for build automation, JSDoc for documentation, ESLint for code linting, and Browserify for packaging. The license remains Apache-2.0, ensuring open-source usage. The author and repository information are consistent, pointing to Matthew Eernisse and the official GitHub repository.
The key difference lies in the release date and the mocha version. Version 2.5.2 was released on September 7, 2016, whereas 2.5.1 came out on July 25, 2016. More importantly, version 2.5.2 makes use of mocha version ^3.0.2 to test and validates the library, while the version 2.5.1 was based on mocha ^2.1.0. This suggest potential bug fixes and improvements related to testing in the newer version. Developers already using EJS might consider upgrading to 2.5.2 for the latest testing and potentially improved stability. New users should opt for the latest version for an enhanced development experience, benefiting from potential bug fixes and the most up-to-date testing framework. The inclusion of lru-cache and uglify-js points to a focus on performance, while istanbul ensures code coverage during testing, reflecting a commitment to quality.
All the vulnerabilities related to the version 2.5.2 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
