Description
Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| eta-dev | eta | < 2.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | eta | < 2.0.0 | 2.0.0 | GHSA-xrh7-m5pp-39r6 |