GitHub Advisoryadvisory · npm

GHSA-876r-hj45-fw7g Sandbox Breakout / Arbitrary Code Execution in safer-eval

CRITICAL Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
safer-eval
Severity
Critical
Reviewed
2020-08-31

Affected packages

• npm safer-eval: >= 0.0.0 (no fix yet)

Description

All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system. Recommendation The package is not suited to receive arbitrary user input. Consider using an alternative package.

References