Bug 2168980 (CVE-2022-25967) - CVE-2022-25967 eta: Remote Code Execution by overwriting template engine configuration variables
Summary: CVE-2022-25967 eta: Remote Code Execution by overwriting template engine conf...
Keywords:
Status: NEW
Alias: CVE-2022-25967
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2168981
Blocks: 2165588
TreeView+ depends on / blocked
 
Reported: 2023-02-10 21:03 UTC by Zack Miele
Modified: 2025-09-01 08:30 UTC (History)
1 user (show)

Fixed In Version: eta 2.0.0
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Zack Miele 2023-02-10 21:03:17 UTC 
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.

https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21
https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182
https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd
https://security.snyk.io/vuln/SNYK-JS-ETA-2936803
Comment 1 Zack Miele 2023-02-10 21:03:30 UTC 
Created golang-entgo-ent tracking bugs for this issue:

Affects: fedora-36 [bug 2168981]
Note You need to log in before you can comment on or make changes to this bug.