GitHub Advisoryadvisory · npm

GHSA-xrh7-m5pp-39r6 XSS Attack with Express API

HIGH Published 2023-01-31 Modified 2023-02-08 Official page ↗
Aliases
CVE-2023-23630
Ecosystem
npm
Packages
eta
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weaknesses
CWE-79
Reviewed
2023-01-31

Affected packages

• npm eta: < 2.0.0 → fixed in 2.0.0

Description

Impact XSS attack - anyone using the Express API is impacted Patches The problem has been resolved. Users should upgrade to version 2.0.0. Workarounds Don't pass user supplied data directly to `res.renderFile`. References _Are there any links users can visit to find out more?_ See https://github.com/eta-dev/eta/releases/tag/v2.0.0

Related

Alias · CVE (1)

  • CVE-2023-23630 Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References