Paper/Archive/CVE-2023-26121

CVE-2023-26121

snyk — All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of it…

EPSS 1%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (NVD)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 65.9.659 × 2013.2 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.

Affected

ProductAffectedFixed inSource

safe-evalall versions–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

snyk (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refsecurity.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062 refgist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9 refgithub.com/hacksparrow/safe-eval/issues/28