Homepage
About Snyk

eta@1.2.1 vulnerabilities

Lightweight, fast, and powerful embedded JS template engine

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the eta package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

eta is a Lightweight, fast, and powerful embedded JS template engine

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via renderFile function, due to improper user-input sanitization.

How to fix Cross-site Scripting (XSS)?

Upgrade eta to version 2.0.0 or higher.

<2.0.0
  • H
Remote Code Execution (RCE)

eta is a Lightweight, fast, and powerful embedded JS template engine

Affected versions of this package are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API.

Note: This is exploitable only for users who are rendering templates with user-defined data.

How to fix Remote Code Execution (RCE)?

Upgrade eta to version 2.0.0 or higher.

<2.0.0
Go back to all versions of this package