VDB
Sign up
CRITICAL9.8

GHSA-q9v2-7m5w-4693

expr-eval vulnerable to Code Execution

Details

All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/expr-eval
Introduced in: 0

No fixed version published yet for expr-eval (npm). Pin to a known-safe version or switch to an alternative.

Maven/org.webjars.npm:expr-eval
Introduced in: 0

No fixed version published yet for org.webjars.npm:expr-eval (maven). Pin to a known-safe version or switch to an alternative.

References