GitHub Advisoryadvisory · npm

GHSA-v63x-xc9j-hhvq Sandbox Breakout / Arbitrary Code Execution in safer-eval

CRITICAL Published 2019-12-11 Modified 2021-07-28 Official page ↗
Aliases
CVE-2019-10769
Ecosystem
npm
Packages
safer-eval
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-94
Reviewed
2020-06-16

Affected packages

• npm safer-eval: <= 1.3.6 (no fix yet)

Description

All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input. This may allow attackers to execute arbitrary code in the system. Recommendation The package is not meant to receive user input. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-10769 safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References