PT-2019-12041 · Npm · Safe-Eval

Jonathan Leitschuh · Published 2019-12-06 · Updated 2021-07-21 · CVE-2019-10769

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions safer-eval versions all

Description The issue concerns the safer-eval npm package, which is used to sandbox the evaluation of code within the eval function. It is vulnerable to Arbitrary Code Execution via generating a RangeError and Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input, potentially allowing attackers to execute arbitrary code in the system.

Recommendations For all versions, consider using an alternative package until a fix is made available, as the safer-eval package is not meant to receive user input.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

CVE-2019-10769

GHSA-V63X-XC9J-HHVQ

SNYK-JS-SAFEREVAL-534901

Affected Products

Safe-Eval

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-SAFEREVAL-534901 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10769 · Security Note
• https://osv.dev/vulnerability/GHSA-v63x-xc9j-hhvq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10769 · Vendor Advisory
• https://github.com/commenthol/safer-eval/security/advisories/GHSA-v63x-xc9j-hhvq · Note
• https://npmjs.com/advisories/1428 · Note
• https://github.com/advisories/GHSA-v63x-xc9j-hhvq · Note