PT-2020-21412 · Localeval · Localeval

Published 2020-09-04 · Updated 2020-09-04

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions localeval versions (affected versions not specified)

Description The issue allows for Sandbox Escape leading to Remote Code Execution due to the package's failure to restrict access to the main context through constructor.constructor. This could enable attackers to execute arbitrary code in the system. Evaluating a specific payload, such as constructor.constructor("return process.env")(), can return the contents of process.env.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-MMQV-M45H-Q2HP

Affected Products

Localeval

References · 5

• https://osv.dev/vulnerability/GHSA-mmqv-m45h-q2hp · Vendor Advisory
• https://github.com/espadrine/localeval · Note
• https://github.com/espadrine/localeval/commit/ce985eba77a5f89a7f718727cbaa7fb14da40335 · Note
• https://github.com/espadrine/localeval/issues/9 · Note
• https://github.com/espadrine/localeval/commit/823f112c793b8fae051eeddad61d4ed29804a56c · Note