-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| eta | npm | < 2.0.0 | 2.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how renderFile handled configuration merging. In pre-2.0.0 versions, it extracted settings from data.settings (including 'view options') and merged them into the template engine configuration using copyProps. This allowed user-controlled data to modify critical configuration parameters like autoEscape and template functions. The patch removed this insecure configuration merging, switching to a default config instead. The removed test case in file-handlers.spec.ts that used settings from Express confirms this was the attack vector. The Snyk PoC demonstrates how crafted settings could trigger RCE by modifying template engine behavior.
Ongoing coverage of React2Shell