by Kastro
Paper/Archive/CVE-2022-25904

CVE-2022-25904

snyk — Prototype Pollution

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.1.611 × 2012.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.

Affected

ProductAffectedFixed inSource
safe-eval< unspecifiedunspecifiedCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JS-SAFEEVAL-3175701refgithub.com/hacksparrow/safe-eval/issues/26