static-eval Arbitrary Code Execution Vulnerability

static-eval is a module for evaluating statically analyzable expressions. A security vulnerability exists in static-eval. An attacker can exploit this vulnerability to execute arbitrary code by accessing the constructor of the global function...

PT-2018-6255

Name of the Vulnerable Software and Affected Versions: static-eval versions prior to 2.0.0 Description: The issue allows untrusted user input to access the global function constructor, effectively enabling arbitrary code execution. This occurs because affected versions of the static-eval module...

Sandbox Breakout / Arbitrary Code Execution

Overview Affected versions of static-eval pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept var evaluate = require'static-eval'; var parse =...