Prototype pollution in safe-eval
Priority HIGH 76CWE-265Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulnerable functions:** __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), valueOf().
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02101 81st percentileScored 2026-11-07
Public exploit Yes 7 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | safe-eval | all versions | — | No fix listed | CNA |
| — | safe-eval (npm) | up to 0.4.2 | — | No fix listed | GHSA-79xf-67r4-q2jj |
- safe-eval Vendor— Affected all versions Fixed in — No fix listed CNA
- safe-eval (npm) Vendor— Affected up to 0.4.2 Fixed in — No fix listed GHSA-79xf-67r4-q2jj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:safe-eval_project:safe-eval:*:*:*:*:*:node.js:*:* | up to 0.4.1 | Vulnerable | Safe-eval Project |
- cpe:2.3:a:safe-eval_project:safe-eval:*:*:*:*:*:node.js:*:* Versions up to 0.4.1 Vulnerable ·Safe-eval Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26122
- 2026-10-03 Alias added: GHSA-79xf-67r4-q2jj
References
Exploit 7
- https://github.com/hacksparrow/safe-eval/issues/27
- https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cce
- https://github.com/hacksparrow/safe-eval/issues/31
- https://github.com/hacksparrow/safe-eval/issues/32
- https://github.com/hacksparrow/safe-eval/issues/33
- https://github.com/hacksparrow/safe-eval/issues/34
- https://github.com/hacksparrow/safe-eval/issues/35
More Safe-eval Project Safe-eval vulnerabilities
- TI-2023-11346 Prototype pollution in safe-eval CVSS 3.1CRITICAL 10.0
- TI-2022-09459 Prototype pollution in safe-eval CVSS 3.1CRITICAL 9.8
- TI-2017-11808 The safe-eval module describes itself as a safer version of eval. CVSS 3.0CRITICAL 10.0
- TI-2020-06230 Sandbox Escape CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-26122 · CVE Program
- CVE-2023-26122 · NVD
- FIRST EPSS
- GHSA-79xf-67r4-q2jj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences