Description (CNA)
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| HackerOne / static-eval node module node module | affected <=1.1.1 |
CWE
CWE-20
References
- https://nodesecurity.io/advisories/548
- https://maustin.net/articles/2017-10/static_eval
- https://github.com/substack/static-eval/pull/18
ADP enrichment
No English description supplied.