CVE-2019-10759

CRITICAL

safer-eval < 1.3.4 - Arbitrary Code Execution via Constructor Properties

Title source: llm
STIX 2.1

Description

safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.

References (1)

Core 1
Core References
Exploit, Patch, Third Party Advisory x_refsource_confirm
https://snyk.io/vuln/SNYK-JS-SAFEREVAL-173772

Scores

CVSS v3 9.9
EPSS 0.0179
EPSS Percentile 75.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

Status published
Products (2)
npm/safer-eval 0 - 1.3.4npm
safer-eval_project/safer-eval < 1.3.4
Published Oct 15, 2019
Tracked Since Feb 18, 2026