GHSA-mmqv-m45h-q2hp Sandbox Breakout / Arbitrary Code Execution in localeval

• npm localeval: < 15.3.0 → fixed in 15.3.0

All versions of `localeval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `constructor.constructor`. This may allow attackers to execute arbitrary code in the system. Evaluating the payload ``` constructor.constructor("return process.env")() ``` returns the contents of `process.env`. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.