Quick answers
- Is CVE-2021-23334 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-23334 being exploited in the wild.
- How severe is CVE-2021-23334?
- Low severity, with a CVSS score of 3.1, published 6 May 2021.
- Which products and versions are affected?
- static-eval (npm) SEMVER:introduced=0,last_affected=2.1.0.
- Is there a fix for CVE-2021-23334?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2021-23334 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-23334?
- Check whether you run static-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The static-eval library processes JavaScript AST (Abstract Syntax Tree) nodes to evaluate expressions. A proof-of-concept demonstrated that function expressions and template literals containing eval() calls could be used to achieve arbitrary code execution when processed by the library. However, this was withdrawn because static-eval's documented purpose is to safely evaluate only static expressions; passing untrusted code to it represents misuse rather than a product defect. The vulnerability class would have been improper input validation (CWE-94), but the root cause analysis revealed the issue lay with caller misuse, not the library's intended functionality.
Affected products
- static-eval static-eval all versions up to 2.1.0
Identifiers
- CVE-2021-23334
- GHSA-8v27-2fg9-7h62
Timeline
- 2021-02-11: disclosed: Published to NVD
- 2021-05-06: advisory: Published to OSV
- 2021-05-04: other: Advisory withdrawn