Filtered by vendor Eta.js
Subscriptions
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-25967 | 1 Eta.js | 1 Eta | 2024-08-03 | 8.1 High |
| Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data. | ||||
| CVE-2023-23630 | 1 Eta.js | 1 Eta | 2024-08-02 | 8.6 High |
| Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`. | ||||
Page 1 of 1.