GHSA-33vh-7x8q-mg35

Source

https://github.com/advisories/GHSA-33vh-7x8q-mg35

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-33vh-7x8q-mg35/GHSA-33vh-7x8q-mg35.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-33vh-7x8q-mg35

Aliases

CVE-2022-25904

Published

2022-12-20T06:30:36Z

Modified

2025-04-16T16:08:32Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

safe-eval vulnerable to Prototype Pollution

Details

All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.

Database specific

{
    "cwe_ids":  [
        "CWE-1321"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-12-20T17:38:42Z",
    "nvd_published_at":  "2022-12-20T05:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / safe-eval

Package

Name: safe-eval; View open source insights on deps.dev
Purl: pkg:npm/safe-eval

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.4.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-33vh-7x8q-mg35/GHSA-33vh-7x8q-mg35.json"