safe-eval vulnerable to Prototype Pollution via the safeEval function

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-26121 · ADVISORY
• hacksparrow/safe-eval · WEB
• gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9 · WEB
• hacksparrow/safe-eval · PACKAGE
• security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062 · WEB

safe-eval のその他の脆弱性

• CVE-2023-26122緊急 10.0All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from…
• CVE-2022-25904緊急 9.8All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.p…
• CVE-2017-16088緊急 10.0The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access t…