Sandbox Breakout / Prototype Pollution in notevil

Versions of notevil prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload tryab;catchee.constructor.constructor'return...

ezs (>=5.5.0, <=9.3.1), hoppel (0.4.0) +2 more potentially affected by unknown CVE via notevil (>=1.0.0, <=1.3.1)

notevil NPM version =1.0.0, =5.5.0, =1.0.0, =1.0.1 - piedpiper-middle-out 5.8.1 Source cves: unknown CVE Source advisory: GHSA-9GXR-RHX6-4JGV...

ezs (>=5.5.0, <=9.3.1), hoppel (0.4.0) +2 more potentially affected by unknown CVE via notevil (>=1.0.0, <=1.3.1)

notevil NPM version =1.0.0, =5.5.0, =1.0.0, =1.0.1 - piedpiper-middle-out 5.8.1 Source cves: unknown CVE Source advisory: OSV:GHSA-9GXR-RHX6-4JGV...

GHSA-9GXR-RHX6-4JGV Sandbox Breakout / Prototype Pollution in notevil

Versions of notevil prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload tryab;catchee.constructor.constructor'return...

PT-2020-21193

Name of the Vulnerable Software and Affected Versions notevil versions prior to 1.3.3 Description The issue allows for Sandbox Escape leading to Prototype pollution. This occurs because the package fails to restrict access to the main context, enabling an attacker to add or modify an object's...

ezs (>=5.5.0, <=9.3.1), hoppel (0.4.0) +2 more potentially affected by unknown CVE via notevil (>=1.0.0, <=1.3.1)

notevil NPM version =1.0.0, =5.5.0, =1.0.0, =1.0.1 - piedpiper-middle-out 5.8.1 Source cves: unknown CVE Source advisory: GHSA-7R5F-7QR4-PF6Q...

GHSA-7R5F-7QR4-PF6Q Sandbox Breakout / Arbitrary Code Execution in notevil

Versions of notevil prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the Function constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor leading t...

Sandbox Breakout / Arbitrary Code Execution in notevil

Versions of notevil prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the Function constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor leading t...

ezs (>=5.5.0, <=9.3.1), hoppel (0.4.0) +2 more potentially affected by unknown CVE via notevil (>=1.0.0, <=1.3.1)

notevil NPM version =1.0.0, =5.5.0, =1.0.0, =1.0.1 - piedpiper-middle-out 5.8.1 Source cves: unknown CVE Source advisory: OSV:GHSA-7R5F-7QR4-PF6Q...

PT-2020-21131

Name of the Vulnerable Software and Affected Versions notevil versions prior to 1.3.2 Description The issue allows for Sandbox Escape leading to Remote Code Execution due to the package's failure to prevent access to the Function constructor. This is caused by not checking the return values of...

Prototype Pollution

notevil is vulnerable to prototype pollution. The vulnerability exists as it failed to check if the value of the prototype header was tampered...

Node.js third-party modules: [notevil] - Sandbox Escape Lead to RCE on Node.js and XSS in the Browser

I would like to report a sandbox escape / code injection vulnerability in notevil. It allows an attacker to escape the intended sandbox and execute javascript code in the global context, meaning that he/she can achieve arbitrary command execution RCE when running in nodejs and cross site scriptin...

Sandbox Breakout / Arbitrary Code Execution

Overview Versions of notevil prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the Function constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor...