CVE-2022-25967

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.

• CWE-94
• CWE-94

• https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21Broken Link
• https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182Broken Link
• https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138ddPatch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-ETA-2936803Third Party Advisory
• https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/compile-string.ts%23L21Broken Link
• https://github.com/eta-dev/eta/blob/9c8e4263d3a559444a3881a85c1607bf344d0b28/src/file-handlers.ts%23L182Broken Link
• https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138ddPatch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-ETA-2936803Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-ETA-2936803Third Party Advisory

Published

Jan 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25952Cross-Site Request Forgery (CSRF) vulnerability in Keywordru…8.8
• CVE-2022-25957Rejected reason: This candidate was in a CNA pool that was n…
• CVE-2022-25959Omron CX-Position (versions 2.5.3 and prior) is vulnerable t…7.8
• CVE-2022-2596Inefficient Regular Expression Complexity in GitHub reposito…5.9
• CVE-2022-25962All versions of the package vagrant.js are vulnerable to Com…9.8
• CVE-2022-25966Improper access control in the Intel(R) Edge Insights for In…7.8
• CVE-2022-25968Rejected reason: This candidate was in a CNA pool that was n…
• CVE-2022-25969The installer of WPS Office Version 10.8.0.6186 insecurely l…7.8
• CVE-2022-2597The Visual Portfolio, Photo Gallery & Post Grid WordPress pl…5.4
• CVE-2022-25972An out-of-bounds write vulnerability exists in the gif2h5 fu…7.8
• CVE-2022-25973All versions of package mc-kill-port are vulnerable to Arbit…7.8
• CVE-2022-25976Improper input validation in the Intel(R) VROC software befo…5.5