GHSA-xrh7-m5pp-39r6HighCVSS 8.6

XSS Attack with Express API

Published
January 31, 2023
Last Modified
February 8, 2023

🔗 CVE IDs covered (1)

CVE-2023-23630 →

📋 Description

Impact

XSS attack - anyone using the Express API is impacted

Patches

The problem has been resolved. Users should upgrade to version 2.0.0.

Workarounds

Don't pass user supplied data directly to res.renderFile.

References

Are there any links users can visit to find out more? See https://github.com/eta-dev/eta/releases/tag/v2.0.0

🎯 Affected products1

  • npm/eta:< 2.0.0

🔗 References (5)