CVE-2023-23630 — Cross-site (XSS) vulnerability with Express API in Eta
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. User…
Published: 2023-02-01 · CVSS: 8.6 · CVSS 3.1
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7