CVE-2022-25967

Katalog CVE

CVSS 8.8 · High EPSS 2,0%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada eta.js eta. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.

Rincian

Terbit di NVD

30 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-ETA-2936803 advisory pihak ketiga
• https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21 broken link
• https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182 broken link