CVE-2022-25967

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-25967
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21 Broken Link
https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182 Broken Link
https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd Patch Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-ETA-2936803 Third Party Advisory
https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21 Broken Link
https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182 Broken Link
https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd Patch Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-ETA-2936803 Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-ETA-2936803 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:eta.js:eta:*:*:*:*:*:node.js:*:*
History

27 Mar 2025, 21:15

Type Values Removed Values Added
References () https://security.snyk.io/vuln/SNYK-JS-ETA-2936803 - Third Party Advisory () https://security.snyk.io/vuln/SNYK-JS-ETA-2936803 - Third Party Advisory

21 Nov 2024, 06:53

Type Values Removed Values Added
References () https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21 - Broken Link () https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21 - Broken Link
References () https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182 - Broken Link () https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182 - Broken Link
References () https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd - Patch, Third Party Advisory () https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd - Patch, Third Party Advisory
References () https://security.snyk.io/vuln/SNYK-JS-ETA-2936803 - Third Party Advisory () https://security.snyk.io/vuln/SNYK-JS-ETA-2936803 - Third Party Advisory
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 8.1
Summary
  • (es) Las versiones del paquete eta anteriores a la 2.0.0 son vulnerables a la ejecución remota de código (RCE) al sobrescribir las variables de configuración del motor de plantilla con las opciones de visualización recibidas de la API de renderizado Express. **Nota:** Esto solo es explotable para usuarios que renderizan plantillas con datos definidos por el usuario.

07 Nov 2023, 03:44

Type Values Removed Values Added
Summary Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data. Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.
Information

Published : 2023-01-30 05:15

Updated : 2025-03-27 21:15

NVD link : CVE-2022-25967

Mitre link : CVE-2022-25967

CVE.ORG link : CVE-2022-25967

JSON object : View

Products Affected

eta.js

  • eta
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

NVD-CWE-noinfo