EJS (Embedded JavaScript templates) version 2.5.4 arrived shortly after 2.5.3, marking a quick iteration in the library's development. When examining the two releases, the core functionalities and declared dependencies for both versions remain consistent. Developers familiar with 2.5.3 will find a seamless transition to 2.5.4, as the development dependencies, including tools like jake, jsdoc, mocha, eslint, istanbul, lru-cache, uglify-js, browserify, and git-directory-deploy are identical. This suggests that the fundamental build process and testing frameworks were unchanged between the two versions.
The primary distinction lies in the releaseDate. Version 2.5.4 was published on December 5th, 2016, while version 2.5.3 saw its release on November 28th, 2016. This short gap indicates that version 2.5.4 likely contains bug fixes and/or minor updates implemented shortly after the 2.5.3 release. Developers looking for the most up-to-date stable version of EJS should prefer 2.5.4, as it benefits from any immediate post-release adjustments. Both versions continue to be licensed under Apache-2.0 reinforcing the project maintainers commitment to open-source development, making EJS a stable and permissive choice for templating in JavaScript projects. The continued maintenance and consistent dependency declarations highlight EJS as a reliable option.
All the vulnerabilities related to the version 2.5.4 of the package
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
