Skip to content
OpenAdvisories

Package · npm

static-eval

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.3
    GHSA-x9hc-rw35-f44h

    Sandbox Breakout / Arbitrary Code Execution in static-eval

    Versions of `static-eval`prior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. ## Proof of concept ``` var evaluate = require('st…

    static-eval npm
  • Medium —
    CVE-2017-16226

    Sandbox Breakout / Arbitrary Code Execution in static-eval

    The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.

    HackerOne static-eval node module node module static-eval npm