CVE-2026-29053

CVE-2026-29053 Ghost CMS RCE via jsonpath/static-eval prototype chain. Info CVE : CVE-2026-29053 Affected : Ghost -p 1. Start listener: nc -lvnp 2. Upload malicious-theme.zip to Ghost Admin → Settings → Design 3. Create page with slug rce 4. Visit /rce/ References...

ROOT-APP-NPM-CVE-2021-23334 CVE-2021-23334 in static-eval - Patched by Root

Root has patched CVE-2021-23334 in the static-eval package for Root:npm. Multiple fixed versions available...

3d-tiles-tools (>=0.1.0, <=0.1.3), 3m5-coco (>=0.0.2, <=0.0.8) +1183 more potentially affected by unknown CVE via static-eval (>=0.0.0, <=2.0.0)

static-eval NPM version =0.0.0, =0.1.0, =0.0.2, =0.16.0, =0.0.11, =0.1.27, =0.1.2, =1.0.0, =1.1.3, =3.4.0, =5.1.5 - @arve.knudsen/sheetify-stylus 2.0.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0158...

CVE-2026-7191 Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

CVE-2026-7191: Improper Control of Generation of Code

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

CVE-2026-1615

Affected versions of the package jsonpath are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can exploi...

CVE-2026-1615: Improper Control of Generation of Code

Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. An attacker can...

static-eval FunctionExpressions TemplateLiterals Code Execution

The vulnerability of the FunctionExpressions and TemplateLiterals functions in the static-eval package of the NPM package manager is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Withdrawn: Arbitrary Code Execution in static-eval

All versions of package static-eval are vulnerable to Arbitrary Code Execution using FunctionExpressions and TemplateLiterals. PoC: var evaluate = require'static-eval'; var parse = require'esprima'.parse; var src="function x return...

GHSA-8V27-2FG9-7H62 Withdrawn: Arbitrary Code Execution in static-eval

All versions of package static-eval are vulnerable to Arbitrary Code Execution using FunctionExpressions and TemplateLiterals. PoC: var evaluate = require'static-eval'; var parse = require'esprima'.parse; var src="function x return...

PT-2021-3173

Name of the Vulnerable Software and Affected Versions static-eval versions prior to a fixed version Description The issue is related to incorrect code generation management in the FunctionExpressions and TemplateLiterals functions of the static-eval package. This can allow a remote attacker to...

Arbitrary Code Execution

Amendment This was deemed not a vulnerability. Overview static-eval is an evaluates statically-analyzable expressions. Affected versions of this package are vulnerable to Arbitrary Code Execution. This vulnerability was deemed to be not an issue within the library. References - GitHub Additional...

GHSA-X9HC-RW35-F44H Sandbox Breakout / Arbitrary Code Execution in static-eval

Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept var evaluate = require'static-eval'; var parse = require'esprima'.parse;...

Sandbox Breakout / Arbitrary Code Execution in static-eval

Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept var evaluate = require'static-eval'; var parse = require'esprima'.parse;...

@autorest/common (>=1.0.0, <=1.5.2), @autorest/configuration (>=1.1.0-dev.2, <=1.9.2) +56 more potentially affected by unknown CVE via static-eval (2.0.0)

static-eval NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on static-eval and may be impacted: - @autorest/common =1.0.0, =1.1.0-dev.2, =3.0.6371, =4.0.2, =2.0.4, =0.2.0-dev.1, =4.0.149, =3.0.129, =4.0.174, =1.2.5, =1.5.0, =1.0.0, =1.2....

@autorest/common (>=1.0.0, <=1.5.2), @autorest/configuration (>=1.1.0-dev.2, <=1.9.2) +56 more potentially affected by unknown CVE via static-eval (2.0.0)

static-eval NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on static-eval and may be impacted: - @autorest/common =1.0.0, =1.1.0-dev.2, =3.0.6371, =4.0.2, =2.0.4, =0.2.0-dev.1, =4.0.149, =3.0.129, =4.0.174, =1.2.5, =1.5.0, =1.0.0, =1.2....

PT-2020-21586

Name of the Vulnerable Software and Affected Versions static-eval versions prior to 2.0.2 Description The issue allows arbitrary code execution when untrusted user input is parsed via the package, as it passes the input directly to the global function constructor. This can be exploited when user...

Arbitrary Code Execution

static-eval is vulnerable to arbitrary code execution. The vulnerability is possible because there is no protection by sandbox isolated process, allowing the user to input malicious code through it...

Sandbox Breakout / Arbitrary Code Execution

Overview Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept var evaluate = require'static-eval'; var parse =...

GHSA-5MJW-6JRH-HVFQ Sandbox Breakout / Arbitrary Code Execution in static-eval

Affected versions of static-eval pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. Proof of concept js var evaluate = require'static-eval'; var parse = require'esprima'.parse; va...