Description (CNA)
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| HackerOne / safe-eval node module | affected All versions |
CWE
CWE-610
References
- https://github.com/patriksimek/vm2/issues/59
- https://github.com/hacksparrow/safe-eval/issues/5
- https://nodesecurity.io/advisories/337
ADP enrichment
No English description supplied.