← Database

CVE-2022-25967

HIGH CVSS: 8.1 Published: 2023-01-30 Modified: 2026-06-17

Description

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.

Affected Platforms

Eta.Js Eta

Weakness Type

CWE-94, NVD-CWE-noinfo, CWE-94

References