Skip to content
OpenAdvisories

Package · npm

static-eval

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.3
    GHSA-x9hc-rw35-f44h

    Sandbox Breakout / Arbitrary Code Execution in static-eval

    Versions of `static-eval`prior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. ## Proof of concept ``` var evaluate = require('st…

    static-eval npm