Quick answers
- Is CVE-2020-7710 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-7710 being exploited in the wild.
- How severe is CVE-2020-7710?
- Low severity, with a CVSS score of 3.1, published 25 August 2020.
- Which products and versions are affected?
- safe-eval (npm) SEMVER:introduced=0,last_affected=0.4.1.
- Is there a fix for CVE-2020-7710?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2020-7710 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-7710?
- Check whether you run safe-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
safe-eval contains a sandbox escape vulnerability (CWE-94: Improper Control of Generation of Code) caused by insufficient restriction on prototype manipulation and constructor access through Error objects. An attacker can set a custom __proto__ on an Error object and manipulate the stack property to return a function via a match method that accesses the constructor chain, gaining access to the global context and eval-like functionality. The attack requires no authentication or user interaction—the vulnerable code path is reached whenever untrusted code is passed to safe-eval's evaluation function. An attacker can execute arbitrary system commands, read process environment variables, or achieve full remote code execution. No patch is available; the recommendation is to use an alternative sandboxing solution.
Affected products
- safe-eval safe-eval all versions up to and including 0.4.1
Identifiers
- CVE-2020-7710
- GHSA-hrpq-r399-whgw
Timeline
- 2020-08-25: disclosed
- 2020-08-21: other: NVD published