CVE-2019-10759 - safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution

Back Back to CVE browser

CRITICAL

safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution

Published Oct 15, 2019

9.9

CRITICAL

CVSS 3.1

EPSS 1.79%

Description

safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.

Affected products

Vendor Snyk Product Safer-Eval Default
n/a
- Version
  All versions prior to version 1.3.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Snyk

Safer-Eval

n/a

Version	Status	Constraints
All versions prior to version 1.3.4	affected	-

Ecosystem	Package	Introduced	Fixed
npm	safer-eval	0	1.3.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (4)

https://github.com/advisories/GHSA-r3x4-wr4h-pw33
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10759
https://snyk.io/vuln/SNYK-JS-SAFEREVAL-173772
x_refsource_CONFIRMExploitPatchThird Party Advisory
https://www.npmjs.com/advisories/1021

Link	Providers	Tags
https://github.com/advisories/GHSA-r3x4-wr4h-pw33		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10759
https://snyk.io/vuln/SNYK-JS-SAFEREVAL-173772		x_refsource_CONFIRMExploitPatchThird Party Advisory
https://www.npmjs.com/advisories/1021