safe-eval vulnerable to Prototype Pollution via the safeEval function

严重 10.0CVE-2023-26121 · GHSA-hcg3-56jf-x4vh · Published 11/04/2023 · updated 17/06/2026

要点

CVE-2023-26121 是影响 safe-eval (safe-eval project), safe-eval 的严重 (CVSS 10.0)漏洞。
未来 30 天内被利用的概率（EPSS）：1.1%，高于 66.1% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
safe-eval safe-eval_project	`≤ 0.4.1`	No fix yet
safe-eval npm	`≤ 0.4.2`	No fix yet

Description

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.

NVD description

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.

References

nvd.nist.gov/vuln/detail/CVE-2023-26121 · ADVISORY
hacksparrow/safe-eval · WEB
gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9 · WEB
hacksparrow/safe-eval · PACKAGE
security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062 · WEB

safe-eval 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

safe-eval

safe-eval_project

≤ 0.4.1

No fix yet

safe-eval

npm

≤ 0.4.2

No fix yet

Description

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.

NVD description

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.

safe-eval 的其他漏洞

查看全部 →