MAL-2025-19884 Malicious code in eta-xml-wind-parse-cron (npm)

The package eta-xml-wind-parse-cron was found to contain malicious code...

MAL-2025-26649 Malicious code in monitor-eta-decode-cold-assert (npm)

The package monitor-eta-decode-cold-assert was found to contain malicious code...

MAL-2025-37245 Malicious code in try-test-cluster-eta-enum (npm)

The package try-test-cluster-eta-enum was found to contain malicious code...

MAL-2025-19882 Malicious code in eta-chi-socket-easy-module (npm)

The package eta-chi-socket-easy-module was found to contain malicious code...

MAL-2025-23219 Malicious code in info-gamma-eta-xi-cluster (npm)

The package info-gamma-eta-xi-cluster was found to contain malicious code...

MAL-2025-32039 Malicious code in reject-eta-xi-wind-query (npm)

The package reject-eta-xi-wind-query was found to contain malicious code...

MAL-2025-18219 Malicious code in delta-eta-encrypt-node-thread (npm)

The package delta-eta-encrypt-node-thread was found to contain malicious code...

Malicious code in reject-eta-xi-wind-query (npm)

The package reject-eta-xi-wind-query was found to contain malicious code...

Malicious code in eta-chi-socket-easy-module (npm)

The package eta-chi-socket-easy-module was found to contain malicious code...

MAL-2025-25908 Malicious code in map-driver-eta (npm)

The package map-driver-eta was found to contain malicious code...

MAL-2025-14940 Malicious code in assert-tau-eta-good-earth (npm)

The package assert-tau-eta-good-earth was found to contain malicious code...

MAL-2025-19883 Malicious code in eta-reject-fork-char-cat (npm)

The package eta-reject-fork-char-cat was found to contain malicious code...

CVE-2023-23630

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2022-25967

A flaw was found in the ETA npm package. Affected versions of this package are vulnerable to remote code execution RCE by overwriting template engine configuration variables with view options received from The Express render API...

Cross-site Scripting (XSS)

eta is vulnerable to Cross-site Scripting XSS. The vulnerability exists in file-handlers.ts due to improper user-input sanitization from the Express API allowing an attacker to inject and execute malicious JavaScript...

CVE-2023-23630

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630

CVE-2023-23630 affects Eta, a JS templating engine used with Node/Express; the XSS vulnerability exists when user-supplied data is passed to res.render. Root cause is improper handling of input leading to script injection. The issue has been fixed in Eta v2.0.0. Workarounds include not passing us...

CVE-2023-23630

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to "res.render"...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...