# CVE-2022-25904: hacksparrow safe-eval Prototype Pollution in safeEval

Source: https://junglewise.ai/threats/cve-2022-25904-hacksparrow-safe-eval-prototype-pollution-in-safeeval  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-12-20. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2022-25904 · Severity: low · CVSS 3.1 · Published 2022-12-20

safe-eval is a Node.js library designed to execute JavaScript code in a restricted environment more safely than the standard eval() function. A vulnerability in this library allows an attacker to perform 'prototype pollution,' which can lead to the modification of global object properties. In practice, this could allow an attacker to bypass security checks, crash the application, or potentially execute unauthorized code, compromising the integrity and availability of the service.

Technologies: [safe-eval (npm)](https://junglewise.ai/threats/technologies/safe-eval). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25904 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25904 being exploited in the wild.

**How severe is CVE-2022-25904?** Low severity, with a CVSS score of 3.1, published 20 December 2022.

**Which products and versions are affected?** safe-eval (npm) SEMVER:introduced=0,last_affected=0.4.1.

**Is there a fix for CVE-2022-25904?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-25904 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-25904?** Check whether you run safe-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

All versions of the safe-eval npm package (up to and including 0.4.1) are vulnerable to Prototype Pollution. The vulnerability exists because the safeEval function utilizes the Node.js 'vm' module in a way that allows executed code to access and modify the 'Object.prototype'. By passing a specially crafted string (e.g., using '__proto__') to the safeEval function, an attacker can inject or overwrite properties on the base Object prototype. This can result in application-wide side effects, including Denial of Service (DoS) or Remote Code Execution (RCE) if the polluted properties are later used in sensitive operations. As of the advisory date, there is no official patch available, and the maintainer recommends only running trusted code.

## Affected products

- hacksparrow safe-eval <= 0.4.1

## Identifiers

- CVE-2022-25904
- GHSA-33vh-7x8q-mg35

## Timeline

- 2022-12-17: disclosed: Issue reported on GitHub repository
- 2022-12-19: advisory: Snyk published advisory
- 2022-12-20: advisory: GitHub Advisory and NVD entry published

## References

- [https://github.com/hacksparrow/safe-eval/issues/26](https://github.com/hacksparrow/safe-eval/issues/26)
- [https://github.com/hacksparrow/safe-eval](https://github.com/hacksparrow/safe-eval)
- [https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3175701](https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3175701)

## Related threats

- [safe-eval sandbox bypass via prototype pollution](https://junglewise.ai/threats/cve-2023-26122-safe-eval-sandbox-bypass-via-prototype-pollution)
- [safe-eval prototype pollution in safeEval function](https://junglewise.ai/threats/cve-2023-26121-safe-eval-prototype-pollution-in-safeeval-function)
- [safe-eval sandbox escape and arbitrary code execution](https://junglewise.ai/threats/safe-eval-sandbox-escape-and-arbitrary-code-execution-8c44a96c)
- [safe-eval sandbox escape and arbitrary code execution](https://junglewise.ai/threats/cve-2020-7710-safe-eval-sandbox-escape-and-arbitrary-code-execution)
- [safe-eval sandbox escape via constructor access](https://junglewise.ai/threats/cve-2017-16088-safe-eval-sandbox-escape-via-constructor-access)