ezs (>=5.5.0, <=9.3.1), hoppel (0.4.0) +2 more potentially affected by unknown CVE via notevil (>=1.0.0, <=1.3.1)

notevil NPM version =1.0.0, =5.5.0, =1.0.0, =1.0.1 - piedpiper-middle-out 5.8.1 Source cves: unknown CVE Source advisory: OSV:GHSA-7R5F-7QR4-PF6Q...

GHSA-7R5F-7QR4-PF6Q Sandbox Breakout / Arbitrary Code Execution in notevil

Versions of notevil prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the Function constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor leading t...

Sandbox Breakout / Arbitrary Code Execution in notevil

Versions of notevil prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the Function constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor leading t...

PT-2020-21131

Name of the Vulnerable Software and Affected Versions notevil versions prior to 1.3.2 Description The issue allows for Sandbox Escape leading to Remote Code Execution due to the package's failure to prevent access to the Function constructor. This is caused by not checking the return values of...

Prototype Pollution

notevil is vulnerable to prototype pollution. The vulnerability exists as it failed to check if the value of the prototype header was tampered...

Node.js third-party modules: [notevil] - Sandbox Escape Lead to RCE on Node.js and XSS in the Browser

I would like to report a sandbox escape / code injection vulnerability in notevil. It allows an attacker to escape the intended sandbox and execute javascript code in the global context, meaning that he/she can achieve arbitrary command execution RCE when running in nodejs and cross site scriptin...

Sandbox Breakout / Arbitrary Code Execution

Overview Versions of notevil prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the Function constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor...