Vendors / Eta.js Records 2 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 2
Exploited now Eta.js records in CISA KEV No Eta.js vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 73
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01995 · Published 2023-01-30 · Partial fix · 2.0.0 CWE-94
Priority MEDIUM 44
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser.
CVSS 3.1 HIGH 8.6· Network · No auth · No interaction · EPSS 0.00614 · Published 2023-02-01 · Fixed in 2.0.0 CWE-79
Open these records in search → All records by CVSS severity
0 2 0 0 0
