Description
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data.
Recommendation
Update the eta package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.0
- Patched version(s): 2.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Eta vulnerable to Code Injection via templates rendered with user-defined data and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Matrix-appservice-irc vulnerable to sql injection via roomIds argument - CVE-2022-3971
- Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule - CVE-2025-67750
- React Editable Json Tree vulnerable to arbitrary code execution via function parsing - CVE-2022-36010
- Joplin Vulnerable to Code Injection - CVE-2022-23340
You might also like:
See something that needs correcting? Let us knowUpdated February 07, 2023