CVE-2022-25904

HIGH

safe-eval < 0.4.1 - Prototype Pollution via safeEval Function

Title source: llm

Description

All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.

References (2)

Core 2

Core References

Exploit, Issue Tracking, Third Party Advisory

https://github.com/hacksparrow/safe-eval/issues/26

Exploit, Issue Tracking, Third Party Advisory

https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3175701

Scores

CVSS v3 7.5

EPSS 0.0088

EPSS Percentile 54.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-1321

Status published

Products (2)

npm/safe-eval 0npm

safe-eval_project/safe-eval < 0.4.1

Published Dec 20, 2022

Tracked Since Feb 18, 2026