GHSA-xrh7-m5pp-39r6

XSS Attack with Express API

Source: GitHub Advisory Database (reviewed) High CVE-2023-23630

Packages

Ecosystem	Package	Affected	Fixed in
npm	eta	< 2.0.0	2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact XSS attack - anyone using the Express API is impacted ### Patches The problem has been resolved. Users should upgrade to version 2.0.0. ### Workarounds Don't pass user supplied data directly to `res.renderFile`. ### References _Are there any links users can visit to find out more?_ See https://github.com/eta-dev/eta/releases/tag/v2.0.0

References

External links from the advisory. They lead to third-party sites.

https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6 web
https://nvd.nist.gov/vuln/detail/CVE-2023-23630 advisory
https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd web
https://github.com/eta-dev/eta package
https://github.com/eta-dev/eta/releases/tag/v2.0.0 web