XSS Attack with Express API

Description

XSS attack - anyone using the Express API is impacted

Recommendation

Update the eta package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-xrh7-m5pp-39r6
• CVE-2023-23630
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cube API denial of service attack - CVE-2023-50709
• Cross-Site-Scripting attack on `<RichTextField>` - CVE-2023-25572
• Phishing attack vulnerability by uploading malicious HTML file - CVE-2023-32689
• Unauthorized Access to Private Fields in User Registration API (GHSA-gc7p-j5xm-xxh2) - CVE-2023-39345

Tags:

npm

eta