~ / search / GHSA-79xf-67r4-q2jj

GHSA-79xf-67r4-q2jj

safe-eval vulnerable to Sandbox Bypass due to improper input sanitization

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-26122

Packages

EcosystemPackageAffectedFixed in
npm safe-eval <= 0.4.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution (RCE). **Vulnerable functions:** __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), valueOf().

References

External links from the advisory. They lead to third-party sites.