Executive brief
safe-eval is a JavaScript library designed to safely evaluate untrusted code in a sandboxed environment. This vulnerability allows attackers to break out of the sandbox by accessing object constructors, giving them unrestricted access to Node.js standard library functions including the ability to terminate processes or execute arbitrary code. Any application using safe-eval to execute untrusted user input is at risk of complete compromise.
Technical details
This is a sandbox escape vulnerability in the safe-eval library caused by inadequate isolation of JavaScript object constructors. An unauthenticated attacker can pass malicious code like `this.constructor.constructor('return process')().exit()` which exploits the constructor chain to access Node.js's `process` object and invoke arbitrary functions. The vulnerability affects all versions prior to 0.4.0; no authentication or user interaction is required—only network access to an application using safe-eval. An attacker can achieve remote code execution, process termination, and access to the entire Node.js standard library. The fix is to update to version 0.4.0 or later.
Affected products
- npm safe-eval 0.3.0 and earlier
Timeline
- 2017-03-04: disclosed: Issue reported on GitHub
- 2018-07-18: advisory: GHSA advisory published