CVE-2017-16088 | BDVDB-2026-101830 Detail

HackerOnesafe-eval node module

Description#

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-610 Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

References#

https://github.com/patriksimek/vm2/issues/59
https://github.com/hacksparrow/safe-eval/issues/5
https://nodesecurity.io/advisories/337

Exploit#

No public exploit known

History#

Version 12018-06-07Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.