Arbitrary Code Execution Vulnerability in Safer-eval Prior to 1.3.2
CVE-2019-10760

9.9CRITICAL

Key Information:

Vendor

Snyk

Status
Safer-eval
Vendor
CVE Published:
15 October 2019

Badges

👾 Exploit Exists🟣 EPSS 10%

What is CVE-2019-10760?

Safer-eval versions prior to 1.3.2 expose a critical vulnerability that allows attackers to execute arbitrary code by utilizing constructor properties to escape the sandbox environment. This issue can lead to unauthorized code execution in the context of the application, posing significant security risks. It is crucial for users and administrators to update to the latest version to mitigate these vulnerabilities and secure their JavaScript applications.

Affected Version(s)

safer-eval All versions prior to version 1.3.2

References

https://snyk.io/vuln/SNYK-JS-SAFEREVAL-473029
x_refsource_CONFIRM

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.