# CVE-2017-16088: safe-eval sandbox escape via constructor access

Source: https://junglewise.ai/threats/cve-2017-16088-safe-eval-sandbox-escape-via-constructor-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16088 · Severity: low · CVSS 3 · Published 2018-07-18

safe-eval is a JavaScript library designed to safely evaluate untrusted code in a sandboxed environment. This vulnerability allows attackers to break out of the sandbox by accessing object constructors, giving them unrestricted access to Node.js standard library functions including the ability to terminate processes or execute arbitrary code. Any application using safe-eval to execute untrusted user input is at risk of complete compromise.

Technologies: [safe-eval (npm)](https://junglewise.ai/threats/technologies/safe-eval). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-16088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16088 being exploited in the wild.

**How severe is CVE-2017-16088?** Low severity, with a CVSS score of 3, published 18 July 2018.

**Which products and versions are affected?** safe-eval (npm) 0.3.0 and earlier.

**Is there a fix for CVE-2017-16088?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-16088 attacked?** It is attacked over the network.

**Am I affected by CVE-2017-16088?** Check whether you run safe-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a sandbox escape vulnerability in the safe-eval library caused by inadequate isolation of JavaScript object constructors. An unauthenticated attacker can pass malicious code like `this.constructor.constructor('return process')().exit()` which exploits the constructor chain to access Node.js's `process` object and invoke arbitrary functions. The vulnerability affects all versions prior to 0.4.0; no authentication or user interaction is required—only network access to an application using safe-eval. An attacker can achieve remote code execution, process termination, and access to the entire Node.js standard library. The fix is to update to version 0.4.0 or later.

## Affected products

- npm safe-eval 0.3.0 and earlier

## Identifiers

- CVE-2017-16088
- GHSA-ww6v-677g-p656

## Timeline

- 2017-03-04: disclosed: Issue reported on GitHub
- 2018-07-18: advisory: GHSA advisory published

## References

- [https://github.com/hacksparrow/safe-eval/issues/5](https://github.com/hacksparrow/safe-eval/issues/5)

## Related threats

- [safe-eval sandbox bypass via prototype pollution](https://junglewise.ai/threats/cve-2023-26122-safe-eval-sandbox-bypass-via-prototype-pollution)
- [safe-eval prototype pollution in safeEval function](https://junglewise.ai/threats/cve-2023-26121-safe-eval-prototype-pollution-in-safeeval-function)
- [hacksparrow safe-eval Prototype Pollution in safeEval](https://junglewise.ai/threats/cve-2022-25904-hacksparrow-safe-eval-prototype-pollution-in-safeeval)
- [safe-eval sandbox escape and arbitrary code execution](https://junglewise.ai/threats/safe-eval-sandbox-escape-and-arbitrary-code-execution-8c44a96c)
- [safe-eval sandbox escape and arbitrary code execution](https://junglewise.ai/threats/cve-2020-7710-safe-eval-sandbox-escape-and-arbitrary-code-execution)