Skip to content
OpenAdvisories

Package · npm

notevil

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.5
    CVE-2021-23771

    Sandbox Bypass

    This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an ob…

    notevil argencoders-notevil npm
  • Medium —
    GHSA-9gxr-rhx6-4jgv

    Sandbox Breakout / Prototype Pollution in notevil

    Versions of `notevil` prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload ```try{a[b];}catch…

    notevil npm
  • High —
    GHSA-7r5f-7qr4-pf6q

    Sandbox Breakout / Arbitrary Code Execution in notevil

    Versions of `notevil` prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the `Function` constructor by not checking the return values of function calls. This allows attackers to access the …

    notevil npm