Executive brief
notevil is a JavaScript library designed to safely evaluate untrusted code in a sandboxed environment. Versions prior to 1.3.3 contain a vulnerability that allows attackers to escape the sandbox and pollute the Function prototype, potentially enabling arbitrary code execution or manipulation of global objects across an application.
Technical details
The vulnerability is a sandbox escape leading to prototype pollution (CWE-1321) in notevil versions before 1.3.3. The package fails to properly restrict access to the main JavaScript context. An attacker can craft a malicious payload—such as try{a[b];}catch(e){e.constructor.constructor('return __proto__.arguments.callee.__proto__.polluted=true')()}—that leverages error handling and constructor chains to add or modify the Function prototype. This allows pollution of global object properties, affecting all code running in the same context. The attack requires the ability to pass untrusted code to notevil's evaluation function; no authentication is needed. The fix is available in version 1.3.3 and later.
Affected products
- notevil notevil <1.3.3
Timeline
- 2020-09-04: disclosed
- 2020-09-04: patched: Fix available in version 1.3.3 and later