CVE-2022-25967 Eta vulnerable to Code Injection via templates rendered with user-defined data
Attackers can execute arbitrary code by overwriting template configuration via user-defined data in Express render API calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25967?
CVE-2022-25967 is a high-severity code injection vulnerability in eta, published on 30 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.
Weakness: CWE-94
Which versions are affected by CVE-2022-25967?
2 open source packages ship an affected version, including eta. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
eta npm | All versions | 2.0.0 |
eta npm | All versions | 2.0.0 |
Products include Eta.js Eta.
How do I fix CVE-2022-25967?
Upgrade eta to 2.0.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-25967 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-25967 exists.
Other vulnerabilities in eta
Sources
Also known as GHSA-mf6x-hrgr-658f.