eta-dev/eta · Security
XSS Attack with Express API
- GHSA ID
- GHSA-xrh7-m5pp-39r6
- CVE ID
- CVE-2023-23630
- Severity
- high
- Published
- Updated
- CVSS
- 8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- CVSS v3
- 8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Description
Impact
XSS attack - anyone using the Express API is impacted
Patches
The problem has been resolved. Users should upgrade to version 2.0.0.
Workarounds
Don't pass user supplied data directly to res.renderFile.
References
Are there any links users can visit to find out more? See https://github.com/eta-dev/eta/releases/tag/v2.0.0
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6 ↗
- https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-23630 ↗
- https://github.com/eta-dev/eta/releases/tag/v2.0.0 ↗
- https://github.com/advisories/GHSA-xrh7-m5pp-39r6 ↗