Safe Eval
CVE-2020-7710
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1Blast Radius
ecosystem impact- 1,752 npm packages depend on safe-eval (172 direct, 1,584 indirect)
Ecosystem-wide dependent count for version 0.4.1.
DescriptionNVD
This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.
AnalysisAI
This affects all versions of package safe-eval. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine. Affected products include: Safe-Eval Project Safe-Eval.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. Rated critica
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify proper
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today