search

hacksparrow / safe-eval

Safer version of eval()
257 stars 37 forks source link

Sandbox Escape Bug for safe-eval-2 #39

Open lirantal opened 6 months ago

lirantal commented 6 months ago

The safe-eval-2 package is a fork from several years ago that is now vulnerable to the same security bugs that were disclosed to the safe-eval package too.

There's sadly no way to open an issue in @Lucho forked repository but luckily the package is also not in any significant use by the community so I'm disclosing the issue here for awareness:

  1. proof-of-concept: https://github.com/lirantal/safe-eval-2-CVE
  2. vulnerability write-up