EJS 7

Apply the Node.js 24 prompt first. Use these rules for EJS 7 template rendering on Node.js, and the browser rules when shipping its client bundle.

Template and rendering authority

• Pass only application-owned template text to ejs.compile() and ejs.render(), and only application-owned files to ejs.renderFile(). EJS evaluates JavaScript in templates; sanitizing a user-authored template as HTML does not make it safe to execute.
• Select views from an explicit set of names authorized for the current user and tenant. Do not use a request path directly as a template filename, renderFile() argument, or include() target.
• Build a small view model from approved fields before rendering. Do not pass req.query, req.body, request or session objects, service containers, or callable helpers through to templates; nested values and getters remain live after EJS copies locals.
• Pass compiler and lookup settings in a separate, application-owned options object to ejs.render(template, data, options) or ejs.renderFile(path, data, options, callback). Keep escape, delimiters, filename, root, views, includer, context, and cache settings out of user-controlled data and configuration.
• For Express, register app.engine('ejs', (path, data, callback) => ejs.renderFile(path, data, trustedOptions, callback)) when the app needs EJS options. Carry Express's trusted views and view cache settings into that adapter deliberately. EJS 7 no longer reads EJS options from render locals or app.set('view options'); its default renderFile() integration still reads