CRITICAL10.0
GHSA-79xf-67r4-q2jj
safe-eval vulnerable to Sandbox Bypass due to improper input sanitization
Details
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution (RCE).
**Vulnerable functions:**
__defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), valueOf().
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/safe-eval
Introduced in:
0No fixed version published yet for safe-eval (npm). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-26122[ADVISORY]
- https://github.com/hacksparrow/safe-eval/issues/27[WEB]
- https://github.com/hacksparrow/safe-eval/issues/31[WEB]
- https://github.com/hacksparrow/safe-eval/issues/32[WEB]
- https://github.com/hacksparrow/safe-eval/issues/33[WEB]
- https://github.com/hacksparrow/safe-eval/issues/34[WEB]
- https://github.com/hacksparrow/safe-eval/issues/35[WEB]
- https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cce[WEB]
- https://github.com/hacksparrow/safe-eval[PACKAGE]
- https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064[WEB]