Description
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | static-eval node module node module | <=1.1.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | static-eval | < 2.0.0 | 2.0.0 | GHSA-5mjw-6jrh-hvfq |