Executive brief
safer-eval is a JavaScript library that provides sandboxed code evaluation in Node.js and browsers. Versions before 1.3.4 contain a sandbox escape vulnerability that allows attackers to execute arbitrary code by exploiting constructor property access, potentially compromising any application that uses this library to safely evaluate untrusted code. An attacker with low privileges can escape the sandbox and gain full control over the application environment, including access to sensitive environment variables and file systems.
Technical details
safer-eval is a Node.js/browser library designed to provide safer evaluation of code strings compared to native eval(). The vulnerability exists in versions prior to 1.3.4 and is a sandbox escape flaw (CWE-94: Improper Control of Generation of Code). Attackers can bypass the sandbox by leveraging constructor property chains—for example, the payload `console.constructor.constructor('return process')().env` allows direct access to the Node.js process object and environment variables. The attack requires low privileges and no user interaction; a network-reachable endpoint that evaluates untrusted code using vulnerable versions is immediately exploitable. An attacker achieves remote code execution with full application privileges, enabling data theft, malware deployment, and system compromise. The fix is available in version 1.3.4 and later.
Affected products
- safer-eval safer-eval <1.3.4
Timeline
- 2019-03-08: disclosed
- 2019-10-21: advisory
- 2019-10-15: patched: CVE published; version 1.3.4 available as fix