CVE-2022-25967
1 advisory.
npm/eta CVE-2022-25967: high 8.8
Eta vulnerable to Code Injection via templates rendered with user-defined data
Action: Upgrade eta to 2.0.0 or later.
npm i eta@2.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.0 | - |
Fixed versions
| 2.0.0 |
Sources
- osv: GHSA-mf6x-hrgr-658f
- https://nvd.nist.gov/vuln/detail/CVE-2022-25967
- https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd
- https://github.com/eta-dev/eta
- https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21
- https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182
- https://security.snyk.io/vuln/SNYK-JS-ETA-2936803
CVE-2022-25967 · published · modified · JSON