Versions of safer-eval
prior to 1.3.4 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. For example, evaluating he string console.constructor.constructor('return process')().env
prints process.env
to the console.
Upgrade to version 1.3.4 or later.