CVE-2023-26122

Description

All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulnerable functions:** __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), valueOf().

Weakness classification

• report@snyk.io: CWE-265
• nvd@nist.gov: CWE-1321
• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-1321

Primary references

• report@snyk.io — Exploit, Third Party Advisory
• report@snyk.io — Exploit, Issue Tracking, Third Party Advisory
• report@snyk.io — Exploit, Issue Tracking, Third Party Advisory
• report@snyk.io — Exploit, Issue Tracking, Third Party Advisory
• report@snyk.io — Exploit, Issue Tracking, Third Party Advisory
• report@snyk.io — Exploit, Issue Tracking, Third Party Advisory
• report@snyk.io — Exploit, Issue Tracking, Third Party Advisory
• report@snyk.io — Exploit, Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory