Sandbox Breakout / Arbitrary Code Execution in safer-eval

CRITICO 9.9CVE-2019-10760 · GHSA-hgch-jjmr-gp7w · SNYK-JS-SAFEREVAL-473029 · Published 15/10/2019 · updated 17/06/2026

In breve

CVE-2019-10760 è una vulnerabilità CRITICO (CVSS 9.9) che riguarda safer-eval (safer-eval project), safer-eval.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.9%, superiore al 86.9% delle vulnerabilità.
Correzione: aggiornare a 1.3.2 o successiva.

Package	Affected versions	Patched versions
safer-eval safer-eval_project	`< 1.3.2`	`1.3.2`
safer-eval npm	`< 1.3.2`	`1.3.2`

Description

Versions of safer-eval before 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.

Recommendation

Upgrade to version 1.3.2.

NVD description

safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.

References

nvd.nist.gov/vuln/detail/CVE-2019-10760 · ADVISORY
commenthol/safer-eval commit 1c29f6a · WEB
snyk.io/vuln/SNYK-JS-SAFEREVAL-473029 · WEB
npmjs.com/advisories/787 · WEB

Altre vulnerabilità di safer-eval

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free