CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta
Attackers can execute arbitrary scripts in user browsers via XSS in the Eta templating engine's Express API integration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-23630?
CVE-2023-23630 is a high-severity cross-site scripting vulnerability in eta-dev eta, published on 1 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.
Weakness: CWE-79
Which versions are affected by CVE-2023-23630?
2 open source packages ship an affected version, including eta. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
eta npm | All versions | 2.0.0 |
eta npm | All versions | 2.0.0 |
Products include Eta.js Eta.
How do I fix CVE-2023-23630?
Upgrade eta to 2.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-23630 being exploited?
There is no known exploitation of CVE-2023-23630 in the wild and no public exploit code.
Other vulnerabilities in eta-dev eta
Sources
Also known as GHSA-xrh7-m5pp-39r6.