Kurz gesagt
- CVE-2023-23630 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in eta (eta.js), eta.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.61%, höher als bei 49.6% aller Schwachstellen.
- Abhilfe: auf 2.0.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| eta | < 2.0.0
| 2.0.0
|
| eta npm | < 2.0.0
| 2.0.0
|
Description
Impact
XSS attack - anyone using the Express API is impacted
Patches
The problem has been resolved. Users should upgrade to version 2.0.0.
Workarounds
Don't pass user supplied data directly to res.renderFile.
References
Are there any links users can visit to find out more?
See https://github.com/eta-dev/eta/releases/tag/v2.0.0
NVD description
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free