CVE-2017-16226 | BDVDB-2026-101966 Detail

HackerOnestatic-eval node module node module

Description#

The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-20 Improper Input Validation

References#

https://nodesecurity.io/advisories/548
https://maustin.net/articles/2017-10/static_eval
https://github.com/substack/static-eval/pull/18

Exploit#

No public exploit known

History#

Version 12018-06-07Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.