EJS security vulnerability

[crazyair]

[mde]

Could you provide me with a little more context here?

[Boydbueno]

https://nvd.nist.gov/vuln/detail/CVE-2017-1000188

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

[RyanZim]

Wow, wasn't aware there was a CVE for this. @qq645381995 You need to upgrade to the latest version of EJS.

@mde Shouldn't we deprecate all the older versions?

[mde]

There's not a great way to prevent people from using older versions, unless we un-publish from NPM, which could cause even worse problems (c.f., "left pad").

[RyanZim]

@mde I was referring to npm deprecate. That way they get a warning in the console on installation.

[mde]

Oh, nice. I haven't used that. (What version of NPM added that? :)) I'll add a deprecation ASAP.

[RyanZim]

@mde I don't remember hearing about it being added, so I don't know if it existed ever since I was in the Node world, or if I just never heard any fanfare.

[mde]

Deprecated all versions < 2.5.5.