Vendors / Safe-eval Project Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 5
CVSS high 0
Exploited now Safe-eval Project records in CISA KEV No Safe-eval Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.
CVSS 3.1 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01111 · Published 2023-04-11 · No fix listed CWE-1321
Priority HIGH 82
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00943 · Published 2022-12-21 · No fix listed CWE-1321
Priority HIGH 76
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization.
CVSS 3.1 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.02101 · Published 2023-04-11 · No fix listed CWE-265
Priority MEDIUM 49
The safe-eval module describes itself as a safer version of eval.
CVSS 3.0 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.03441 · Published 2018-06-07 · No fix listed CWE-610
Priority MEDIUM 45
This affects all versions of package safe-eval.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0143 · Published 2020-08-21 · No fix listed CWE-94
Open these records in search → All records by CVSS severity
5 0 0 0 0
THREATIST.IORead the docs