EJS (Embedded JavaScript templates) offers a simple way to generate dynamic HTML in Node.js and the browser. Comparing versions 2.5.2 and 2.5.3 reveals subtle but potentially impactful changes for developers. Both versions share core dependencies like jake for build tasks, jsdoc for documentation, mocha for testing, eslint for code linting, istanbul for code coverage, lru-cache for performance optimization, and uglify-js for minification.
The key difference lies in the build and deployment tooling. Version 2.5.2 utilizes rimraf for deleting files and directories during the build process. However, this dependency is replaced in version 2.5.3 with git-directory-deploy. This suggests a shift towards a more integrated deployment workflow directly leveraging Git, likely streamlining the process of publishing the generated website or application to a Git-based hosting service. This change is important because it simplifies the process of deploying an EJS powered page or a static site.
Developers considering upgrading to 2.5.3 should evaluate if their existing deployment pipeline depends on rimraf. If so, adjustments will be needed. However, for those leveraging Git for deployment, the integrated git-directory-deploy could offer a smoother and more efficient solution. Both versions offer the core templating functionality. EJS remains a lightweight and flexible templating choice whether you’re building server-side rendered applications or dynamic content for the client side. The Apache-2.0 license ensures freedom for both commercial and personal projects.
All the vulnerabilities related to the version 2.5.3 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
