GitHub Advisoryadvisory · npm

GHSA-79xf-67r4-q2jj safe-eval vulnerable to Sandbox Bypass due to improper input sanitization

CRITICAL Published 2023-04-11 Modified 2023-04-19 Official page ↗
Aliases
CVE-2023-26122
Ecosystem
npm
Packages
safe-eval
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2023-04-11

Affected packages

• npm safe-eval: <= 0.4.2 (no fix yet)

Description

All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution (RCE). Vulnerable functions: __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), valueOf().

Related

Alias · CVE (1)

  • CVE-2023-26122 All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References