# CVE-2019-10760: safer-eval sandbox escape via constructor property

Source: https://junglewise.ai/threats/cve-2019-10760-safer-eval-sandbox-escape-via-constructor-property  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-10-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-10760 · Severity: low · CVSS 3.1 · Published 2019-10-17

safer-eval is a Node.js library that attempts to safely evaluate JavaScript code in an isolated sandbox. Versions before 1.3.2 contain a critical vulnerability that allows attackers to escape the sandbox and execute arbitrary code on the server by exploiting constructor properties. This can lead to complete system compromise if the application uses safer-eval to run untrusted code.

Technologies: [safer-eval (npm)](https://junglewise.ai/threats/technologies/safer-eval). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-10760 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-10760 being exploited in the wild.

**How severe is CVE-2019-10760?** Low severity, with a CVSS score of 3.1, published 17 October 2019.

**Which products and versions are affected?** safer-eval (npm) SEMVER:introduced=0,fixed=1.3.2.

**Is there a fix for CVE-2019-10760?** Yes. safer-eval (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-10760 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-10760?** Check whether you run safer-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- safer-eval (npm): upgrade to 1.3.2 or later

  ```sh
  npm install safer-eval@1.3.2
  ```


## Technical details

The vulnerability is a sandbox escape (CWE-94) in safer-eval versions before 1.3.2, where an attacker can use JavaScript constructor properties to break out of the VM isolation and execute arbitrary code. The vulnerability requires the attacker to provide the code to be evaluated (via application usage of safer-eval), but does not require authentication or user interaction beyond that. The fix (version 1.3.2) disables the Object.constructor function within the sandbox context to prevent this technique. The attack is practical and demonstrated in public exploits.

## Affected products

- safer-eval safer-eval before 1.3.2

## Identifiers

- CVE-2019-10760
- GHSA-hgch-jjmr-gp7w

## Timeline

- 2019-10-15: disclosed: NVD published CVE-2019-10760
- 2019-10-17: advisory: GitHub advisory GHSA-hgch-jjmr-gp7w published
- 2019-10-16: patched: Fix committed to address Object.constructor sandbox escape

## References

- [https://github.com/commenthol/safer-eval/commit/1c29f6a6e304fb650c05056e217e457a0d2cc3c5](https://github.com/commenthol/safer-eval/commit/1c29f6a6e304fb650c05056e217e457a0d2cc3c5)

## Related threats

- [safer-eval sandbox breakout arbitrary code execution](https://junglewise.ai/threats/safer-eval-sandbox-breakout-arbitrary-code-execution-6fed75c1)
- [safer-eval sandbox breakout via Object.constructor](https://junglewise.ai/threats/safer-eval-sandbox-breakout-via-object-constructor-d8e87f1c)
- [safer-eval sandbox breakout and arbitrary code execution](https://junglewise.ai/threats/cve-2019-10769-safer-eval-sandbox-breakout-and-arbitrary-code-execution)
- [safer-eval sandbox escape and arbitrary code execution](https://junglewise.ai/threats/cve-2019-10759-safer-eval-sandbox-escape-and-arbitrary-code-execution)