https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T00:24:21.895437+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-221623 EUVD-2026-221623 2026-10-08T00:24:21.898734+00:00 EUVD-2026-221623 https://cve.radiocsirt.org/vuln/fkie_cve-2023-23630 fkie_cve-2023-23630 2026-10-08T00:24:21.898768+00:00

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.

 https://cve.radiocsirt.org/vuln/ghsa-xrh7-m5pp-39r6 GHSA-xrh7-m5pp-39r6 — XSS Attack with Express API 2026-10-08T00:24:21.898800+00:00

Affected: npm: eta

### Impact XSS attack - anyone using the Express API is impacted

### Patches The problem has been resolved. Users should upgrade to version 2.0.0.

### Workarounds Don't pass user supplied data directly to `res.renderFile`.

### References _Are there any links users can visit to find out more?_ See https://github.com/eta-dev/eta/releases/tag/v2.0.0

 https://cve.radiocsirt.org/vuln/gsd-2023-23630 gsd-2023-23630 2026-10-08T00:24:21.898826+00:00 gsd-2023-23630