GHSA-876r-hj45-fw7g

Suggest an improvement
Source
https://github.com/advisories/GHSA-876r-hj45-fw7g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-876r-hj45-fw7g/GHSA-876r-hj45-fw7g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-876r-hj45-fw7g
Published
2020-09-03T21:18:41Z
Modified
2020-08-31T18:51:25Z
Summary
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Details

All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system.

Recommendation

The package is not suited to receive arbitrary user input. Consider using an alternative package.

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:51:25Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}
References

Affected packages

npm / safer-eval

Package

Name
safer-eval
View open source insights on deps.dev
Purl
pkg:npm/safer-eval

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-876r-hj45-fw7g/GHSA-876r-hj45-fw7g.json"