CVE-2023-26121

Опубликовано: 11 апр. 2023

Источник: nvd

CVSS3: 7.5

CVSS3: 10

EPSS Низкий

Описание

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.

Ссылки

https://gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9
Exploit
Third Party Advisory
https://github.com/hacksparrow/safe-eval/issues/28
Exploit
Issue Tracking
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062
Exploit
Third Party Advisory
https://gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9
Exploit
Third Party Advisory
https://github.com/hacksparrow/safe-eval/issues/28
Exploit
Issue Tracking
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:safe-eval_project:safe-eval:*:*:*:*:*:node.js:*:*

Версия до 0.4.1 (включая)

EPSS

Процентиль: 28%

0.001

Низкий

7.5 High

CVSS3

10 Critical

CVSS3

Дефекты

CWE-1321

Связанные уязвимости

GHSA-hcg3-56jf-x4vh

CVSS3: 10

github

почти 3 года назад

safe-eval vulnerable to Prototype Pollution via the safeEval function

EPSS

Процентиль: 28%

0.001

Низкий

7.5 High

CVSS3

10 Critical

CVSS3

Дефекты

CWE-1321