CVE-2023-23630

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.

• CWE-79

• https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138ddPatch, Third Party Advisory
• https://github.com/eta-dev/eta/releases/tag/v2.0.0Release Notes, Third Party Advisory
• https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6Third Party Advisory
• https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138ddPatch, Third Party Advisory
• https://github.com/eta-dev/eta/releases/tag/v2.0.0Release Notes, Third Party Advisory
• https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6Third Party Advisory

Published

Feb 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23625go-unixfs is an implementation of a unix-like filesystem on …7.5
• CVE-2023-23626go-bitfield is a simple bitfield package for the go language…7.5
• CVE-2023-23627Sanitize is an allowlist-based HTML and CSS sanitizer. Versi…6.1
• CVE-2023-23628Metabase is an open source data analytics platform. Affected…4.1
• CVE-2023-23629Metabase is an open source data analytics platform. Affected…6.3
• CVE-2023-2363A vulnerability, which was classified as critical, has been …9.8
• CVE-2023-23631github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that…7.5
• CVE-2023-23632BeyondTrust Privileged Remote Access (PRA) versions 22.2.x t…7.8
• CVE-2023-23634SQL Injection vulnerability in Documize version 5.4.2, allow…9.8
• CVE-2023-23635In Jellyfin 10.8.x through 10.8.3, the name of a collection …5.4
• CVE-2023-23636In Jellyfin 10.8.x through 10.8.3, the name of a playlist is…5.4
• CVE-2023-23637IMPatienT before 1.5.2 allows stored XSS via onmouseover in …7.6