GHSA-5mjw-6jrh-hvfq

Dashboard / Vulnerabilities / GHSA-5mjw-6jrh-hvfq

GHSA-5mjw-6jrh-hvfq

Summary: Sandbox Breakout / Arbitrary Code Execution in static-eval

Details: Affected versions of `static-eval` pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. ## Proof of concept ```js var evaluate = require('static-eval'); var parse = require('esprima').parse; var src = '(function(){console.log(process.pid)})()'; var ast = parse(src).body[0].expression; var res = evaluate(ast, {}); // Will print the process id ``` ## Recommendation Update to version 2.0.0 or later.

References: https://nvd.nist.gov/vuln/detail/CVE-2017-16226, https://github.com/substack/static-eval/pull/18, https://github.com/advisories/GHSA-5mjw-6jrh-hvfq, https://maustin.net/articles/2017-10/static_eval, https://www.npmjs.com/advisories/548