Filtered by vendor Eta.js
Subscribe
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-25967 | 1 Eta.js | 1 Eta | 2025-03-27 | N/A | 8.1 HIGH |
|
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API.
**Note:** This is exploitable only for users who are rendering templates with user-defined data.
|
|||||
| CVE-2023-23630 | 1 Eta.js | 1 Eta | 2024-11-21 | N/A | 8.6 HIGH |
|
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.
|
|||||