CVE-2022-25967CWE-94

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options…

High · published January 30, 2023

CVSS v3.1
8.1
EPSS
2%
Percentile
80.5
In the wild
Unconfirmed
What it is

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CVSS v4.0
Not supplied
EPSS
0.01995 · 80.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-01-30T05:00Z
EPSS history
Timeline
  • 30 JAN 05:00Z
    Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options…
    cvelistv5