high8.6
CVE-2023-23630
XSS Attack with Express API
Impact
### Impact XSS attack - anyone using the Express API is impacted ### Patches The problem has been resolved. Users should upgrade to version 2.0.0. ### Workarounds Don't pass user supplied data directly to `res.renderFile`. ### References _Are there any links users can visit to find out more?_ See https://github.com/eta-dev/eta/releases/tag/v2.0.0
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | eta | < 2.0.0 | 2.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eta.Js | Eta | before 2.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd
- https://github.com/eta-dev/eta/releases/tag/v2.0.0
- https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6
- https://github.com/advisories/GHSA-xrh7-m5pp-39r6
- https://nvd.nist.gov/vuln/detail/CVE-2023-23630