Executive brief
This vulnerability in the static-eval JavaScript library allowed arbitrary code execution through specially crafted function expressions and template literals. The issue was withdrawn after review determined it was not actually a vulnerability in the library itself, but rather a misuse of the library's design—static-eval is intended for evaluating statically-determinable expressions, not untrusted code.
Technical details
The static-eval library processes JavaScript AST (Abstract Syntax Tree) nodes to evaluate expressions. A proof-of-concept demonstrated that function expressions and template literals containing eval() calls could be used to achieve arbitrary code execution when processed by the library. However, this was withdrawn because static-eval's documented purpose is to safely evaluate only static expressions; passing untrusted code to it represents misuse rather than a product defect. The vulnerability class would have been improper input validation (CWE-94), but the root cause analysis revealed the issue lay with caller misuse, not the library's intended functionality.
Affected products
- static-eval static-eval all versions up to 2.1.0
Timeline
- 2021-02-11: disclosed: Published to NVD
- 2021-05-06: advisory: Published to OSV
- 2021-05-04: other: Advisory withdrawn