CVE-2023-26121

2023-04-1105:15:07

CWE-1321

[email protected]

web.nvd.nist.gov

cve-2023-26121

package safe-eval

vulnerability

prototype pollution

safeeval function

nvd

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.5%

JSON

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.

Affected configurations

NVD

Node

safe-eval_projectsafe-evalRange≤0.4.1node.js

CPENameOperatorVersion
safe-eval_project:safe-evalsafe-eval project safe-evalle0.4.1

CPE	Name	Operator	Version
safe-eval_project:safe-eval	safe-eval project safe-eval	le	0.4.1

CNA Affected

[
  {
    "product": "safe-eval",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]