Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-23334: static-eval package can run unauthorized code
CVE-2021-23334 · published today
Summary
The static-eval component used in several JavaScript projects can be tricked into executing code it should not run. This could let an attacker run harmful commands on your system. Update to the latest versions of the static-eval packages from the listed sources to fix the issue.
What to do
- Update static-eval to version 2.0.2-aikido.1.
- Update rootio @rootio/static-eval to version 2.0.2-root.io.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | goto-bus-stop | static-eval | <= 2.1.0 |
| Root:npm | – | static-eval |
< 2.0.2-aikido.1 Fix: upgrade to 2.0.2-aikido.1
|
| Root:npm | rootio | @rootio/static-eval |
< 2.0.2-root.io.1 Fix: upgrade to 2.0.2-root.io.1
|
Original advisory text
CVE-2021-23334 in static-eval - Patched by Root
Root has patched CVE-2021-23334 in the static-eval package for Root:npm. Multiple fixed versions available.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-94Code Injection
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta