Executive brief
localeval is a JavaScript library that attempts to safely evaluate code in a restricted environment. However, the sandbox can be trivially broken, allowing attackers to access variables outside the sandbox and execute arbitrary code with the privileges of the Node.js process or browser context. This bypasses the entire security model of the library.
Technical details
localeval fails to properly restrict access to the global context through the constructor chain. Attackers can use `constructor.constructor()` to break out of the sandbox and execute arbitrary JavaScript code. The vulnerability exists because the function's `this` context is not properly isolated—in the browser, the code used `fn.apply(0, ...)` which exposed the Number prototype, leaking access to outside variables. By calling `this.constructor.constructor('return process.env')()`, an attacker can access environment variables and other global state. The fix introduced in version 15.3.0 changes the context object to use `Object.create(null)` to isolate prototypes, though the attack vector may persist in Node.js contexts.
Affected products
- npm localeval all versions before 15.3.0
Timeline
- 2017-09-22: disclosed: Initial issue reported on GitHub
- 2020-09-04: patched: Fix available in version 15.3.0
- 2020-09-04: advisory: GHSA-mmqv-m45h-q2hp published