CVE-2023-26122
8.8HIGHAll versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerabi
Published: 4/11/2023Updated: 2/7/2025
Description
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulnerable functions:** __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), valueOf().
AI AnalysisPowered by AI
Affected Products
safe-eval_projectsafe-eval
References
- https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cceExploitThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/27ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/31ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/32ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/33ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/34ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/35ExploitIssue TrackingThird Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064ExploitIssue TrackingThird Party Advisory
- https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cceExploitThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/27ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/31ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/32ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/33ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/34ExploitIssue TrackingThird Party Advisory
- https://github.com/hacksparrow/safe-eval/issues/35ExploitIssue TrackingThird Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064ExploitIssue TrackingThird Party Advisory