PT-2023-20502 · Safe-Eval · Safe-Eval

Eongil-Wi + 1 · Publicado 2023-04-11 · Atualizado 2025-02-10 · CVE-2023-26121

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions safe-eval versions all

Description The issue arises from improper sanitization of the parameter content in the safeEval function, leading to Prototype Pollution. This affects all versions of the safe-eval package.

Recommendations For all versions, consider disabling the safeEval function as a temporary workaround until a patch is available. Restrict access to the safeEval function to minimize the risk of exploitation. Avoid using the safeEval function with untrusted input until the issue is resolved.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2023-26121

GHSA-HCG3-56JF-X4VH

Produtos afetados

Safe-Eval

Referências · 9

• 🔥 https://github.com/hacksparrow/safe-eval/issues/28 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062 · Exploit
• 🔥 https://gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9 · Exploit
• https://github.com/hacksparrow/safe-eval · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-26121 · Nota de Segurança
• https://t.me/cvenotify/110603 · Publicação no Telegram
• https://t.me/cvenotify/47946 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-hcg3-56jf-x4vh · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26121 · Aviso do Fabricante