CRITICAL9.8
GHSA-v63x-xc9j-hhvq
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Details
All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input. This may allow attackers to execute arbitrary code in the system.
## Recommendation
The package is not meant to receive user input. Consider using an alternative package until a fix is made available.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/safer-eval
Introduced in:
0No fixed version published yet for safer-eval (npm). Pin to a known-safe version or switch to an alternative.