Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Safer-Eval Arbitrary Code Execution in Older Versions

CVE-2019-10759 · published 7 years ago
Summary

Older versions of Safer-Eval have a security weakness that allows attackers to execute unauthorized code. This could potentially allow an attacker to access sensitive information or disrupt your system. Update to version 1.3.4 or later to fix this issue.

What to do
  • Update commenthol safer-eval to version 1.3.4.
  • Update safer-eval_project safer-eval to version 1.3.4 or later.
Affected software
Ecosystem VendorProductAffected versions
npm commenthol safer-eval < 1.3.4
Fix: upgrade to 1.3.4
– safer-eval_project safer-eval < 1.3.4
cpe:2.3:a:safer-eval_project:safer-eval:*:*:*:*:*:*:*:*
Original advisory text
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published15 Oct 2019
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-r3x4-wr4h-pw33 · GHSA
CVE-2019-10759 · NVD
Track software like this
Free during beta