Executive brief
veval is a JavaScript library designed to safely evaluate code in a sandbox environment. This vulnerability allows attackers to break out of the sandbox and execute arbitrary code on the system where veval is running. An attacker can read sensitive data like environment variables, credentials, and perform malicious actions—a critical risk for any application using veval to execute untrusted code.
Technical details
veval is vulnerable to a sandbox escape via prototype chain access. The vulnerability exists because the library fails to restrict access to this.constructor.constructor, which provides access to the Function constructor. An attacker can craft a payload such as this.constructor.constructor('return process.env')() to break out of the sandbox and execute arbitrary JavaScript in the host context. This allows full remote code execution with the privileges of the Node.js process. The vulnerability affects all versions of veval; no patch is currently available, and the npm advisory recommends using an alternative package.
Affected products
- veval veval all versions
Timeline
- 2020-09-04: disclosed: Vulnerability published on GitHub Advisory Database and npm advisories