GitHub Advisoryadvisory · npm

GHSA-mf6x-hrgr-658f Eta vulnerable to Code Injection via templates rendered with user-defined data

HIGH Published 2023-01-30 Modified 2023-02-07 Official page ↗
Aliases
CVE-2022-25967
Ecosystem
npm
Packages
eta
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2023-02-01

Affected packages

• npm eta: < 2.0.0 → fixed in 2.0.0

Description

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data.

Related

Alias · CVE (1)

  • CVE-2022-25967 Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References