Quick answers
- Is CVE-2019-10760 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-10760 being exploited in the wild.
- How severe is CVE-2019-10760?
- Low severity, with a CVSS score of 3.1, published 17 October 2019.
- Which products and versions are affected?
- safer-eval (npm) SEMVER:introduced=0,fixed=1.3.2.
- Is there a fix for CVE-2019-10760?
- Yes. safer-eval (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-10760 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2019-10760?
- Check whether you run safer-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- safer-eval (npm): upgrade to 1.3.2 or later
npm install safer-eval@1.3.2
Technical details
The vulnerability is a sandbox escape (CWE-94) in safer-eval versions before 1.3.2, where an attacker can use JavaScript constructor properties to break out of the VM isolation and execute arbitrary code. The vulnerability requires the attacker to provide the code to be evaluated (via application usage of safer-eval), but does not require authentication or user interaction beyond that. The fix (version 1.3.2) disables the Object.constructor function within the sandbox context to prevent this technique. The attack is practical and demonstrated in public exploits.
Affected products
- safer-eval safer-eval before 1.3.2
Identifiers
- CVE-2019-10760
- GHSA-hgch-jjmr-gp7w
Timeline
- 2019-10-15: disclosed: NVD published CVE-2019-10760
- 2019-10-17: advisory: GitHub advisory GHSA-hgch-jjmr-gp7w published
- 2019-10-16: patched: Fix committed to address Object.constructor sandbox escape