Executive brief
safe-eval is a JavaScript library used to safely execute code in a sandboxed environment. A prototype pollution vulnerability allows attackers to inject and modify object properties globally, potentially breaking application logic or enabling further exploitation such as arbitrary code execution.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the safeEval function caused by improper sanitization of input parameters. An attacker can craft malicious code that escapes the sandbox and pollutes the prototype chain of JavaScript objects, affecting all objects created thereafter. The attack is network-exploitable with no authentication or user interaction required, and impacts confidentiality, integrity, and availability. All versions up to 0.4.2 are affected; no patch information is currently available.
Affected products
- safe-eval safe-eval 0.4.2 and all previous versions
Timeline
- 2023-04-11: disclosed
- 2023-01-02: other: Vulnerability initially reported on GitHub