CVE-2022-25967

Eta vulnerable to Code Injection via templates rendered with user-defined data

8.1 HighFix available

CVE-2022-25967 is a high vulnerability (CVSS 8.1) in Eta-dev Eta, published January 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in eta 2.0.0.

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.99%Down 3.6 points since Jan 30, 2023

What each source reports

CVE List Score used 8.1

Record: CVE-2022-25967
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Weakness: CWE-94, CWE-94
Updated: 2026-11-02

EUVDEUVD-2023-0508 8.1

Record: EUVD-2023-0508
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mf6x-hrgr-658f 8.8

Eta vulnerable to Code Injection via templates rendered with user-defined data

Record: GHSA-mf6x-hrgr-658f
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 8.1

Record: CVE-2022-25967
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV 8.1

Record: CVE-2022-25967
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-mf6x-hrgr-658f 8.8