CVE-2023-23630
Cross-site (XSS) vulnerability with Express API in Eta
Résumé
Cross-site (XSS) vulnerability with Express API in Eta
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com