In short
- CVE-2023-23630 is a MEDIUM (CVSS 6.1) vulnerability affecting eta (eta.js), eta.
- Chance of exploitation in the next 30 days (EPSS): 0.61%, higher than 49.6% of all vulnerabilities.
- Fix: update to 2.0.0 or later.
| Package | Affected versions | Patched versions |
|---|
| eta | < 2.0.0
| 2.0.0
|
| eta npm | < 2.0.0
| 2.0.0
|
Description
Impact
XSS attack - anyone using the Express API is impacted
Patches
The problem has been resolved. Users should upgrade to version 2.0.0.
Workarounds
Don't pass user supplied data directly to res.renderFile.
References
Are there any links users can visit to find out more?
See https://github.com/eta-dev/eta/releases/tag/v2.0.0
NVD description
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free