Executive brief
static-eval is a JavaScript library used to safely evaluate static expressions in code. Versions before 2.0.2 contain a flaw that allows attackers to break out of the sandbox and execute arbitrary code by crafting malicious input that bypasses restrictions and directly invokes the JavaScript Function constructor, potentially allowing full control over the affected application.
Technical details
The vulnerability is an arbitrary code execution flaw (CWE-94) in static-eval's expression evaluation mechanism. The root cause is that the library passes untrusted user input directly to JavaScript's global Function constructor without proper sanitization or validation. Attackers can exploit this by crafting payloads that leverage object property accessors and constructor chains (e.g., via String.prototype.sub or similar methods) to gain access to the Function constructor and execute arbitrary code. The attack requires only network access to an application using the vulnerable library; no authentication or user interaction is needed. An attacker can achieve full code execution with the privileges of the Node.js process. The vulnerability is fixed in version 2.0.2 and later.
Affected products
- static-eval static-eval <2.0.2
Timeline
- 2019-01-03: disclosed
- 2020-09-02: patched