Malicious code in delta-eta-encrypt-node-thread (npm)

The package delta-eta-encrypt-node-thread was found to contain malicious code...

MAL-2025-25908 Malicious code in map-driver-eta (npm)

The package map-driver-eta was found to contain malicious code...

MAL-2025-14940 Malicious code in assert-tau-eta-good-earth (npm)

The package assert-tau-eta-good-earth was found to contain malicious code...

MAL-2025-26649 Malicious code in monitor-eta-decode-cold-assert (npm)

The package monitor-eta-decode-cold-assert was found to contain malicious code...

MAL-2025-19882 Malicious code in eta-chi-socket-easy-module (npm)

The package eta-chi-socket-easy-module was found to contain malicious code...

CVE-2023-23630

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2022-25967

A flaw was found in the ETA npm package. Affected versions of this package are vulnerable to remote code execution RCE by overwriting template engine configuration variables with view options received from The Express render API...

Cross-site Scripting (XSS)

eta is vulnerable to Cross-site Scripting XSS. The vulnerability exists in file-handlers.ts due to improper user-input sanitization from the Express API allowing an attacker to inject and execute malicious JavaScript...

CVE-2023-23630

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630

CVE-2023-23630 affects Eta, a JS templating engine used with Node/Express; the XSS vulnerability exists when user-supplied data is passed to res.render. Root cause is improper handling of input leading to script injection. The issue has been fixed in Eta v2.0.0. Workarounds include not passing us...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

Eta 跨站脚本漏洞

Eta is Eta open source a lightweight , fast embedded JS template engine . Can run in Node, Deno and browser . A cross-site scripting vulnerability exists in Eta. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

PT-2023-19091 · Eta +1 · Eta +1

Name of the Vulnerable Software and Affected Versions: Eta versions prior to 2.0.0 Description: The issue is related to a XSS attack that impacts anyone using the Express API. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents...

GHSA-MF6X-HRGR-658F Eta vulnerable to Code Injection via templates rendered with user-defined data

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution RCE by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data...

Eta vulnerable to Code Injection via templates rendered with user-defined data

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution RCE by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data...

CVE-2022-25967

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution RCE by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data...

Remote code execution

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution RCE by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data...

CVE-2022-25967

The CVE-2022-25967 issue affects the ETA npm package prior to 2.0.0. An RCE vulnerability arises by overwriting template engine configuration variables with view options received from the Express render API, exploitable only when rendering templates with user-supplied data. Remediation: upgrade E...