Executive brief
safer-eval is a JavaScript library that attempts to safely execute untrusted code in a sandbox environment. The sandbox can be escaped through recursive exception handling, allowing attackers to execute arbitrary code on the system. Applications that use safer-eval to execute user-supplied code are at risk of complete compromise.
Technical details
safer-eval contains a sandbox escape vulnerability that allows attackers to break out of the intended execution sandbox and achieve remote code execution. The vulnerability can be triggered by forcing exceptions recursively in evaluated code, which enables access to the underlying process and module system. The attack is network-reachable if the application exposes code evaluation functionality to untrusted input. The vulnerability affects all versions of safer-eval (from 0.0.0 onwards). No patch has been released; the maintainers recommend discontinuing use of the library and switching to an alternative.
Affected products
- npm safer-eval all versions
Timeline
- 2020-09-03: disclosed: GHSA-876r-hj45-fw7g published