Executive brief
Eta is a template engine commonly used with Express.js applications to render dynamic web content. An attacker can inject malicious scripts through user-supplied data passed directly to the renderFile API, causing cross-site scripting (XSS) attacks that compromise user sessions, steal data, or deface web content.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in Eta's Express API renderFile method. When user-supplied input is passed directly to res.renderFile without sanitization, attacker-controlled data is rendered as executable JavaScript in the browser. The attack vector is network-based and requires no authentication, as an attacker can craft malicious payloads in URL parameters or form data. Successful exploitation allows arbitrary script execution in victim browsers. The vulnerability is resolved in version 2.0.0; users should upgrade or avoid passing unsanitized user data to renderFile.
Affected products
- Eta Eta <=1.14.2
Timeline
- 2023-01-31: disclosed
- 2023-01-31: patched: Fixed in version 2.0.0