CVE-2022-25904
published 2022-12-20CVE-2022-25904: All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the…
PriorityP347critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.88%
54.7th percentile
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| safe-eval_project | safe-eval | < unspecified | unspecified |
| safe-eval_project | safe-eval | <= 0.4.1 | — |
| safe-eval_project | safe-eval | 0 – 0.4.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
safe-eval vulnerable to Prototype Pollution
osv·2022-12-20
CVE-2022-25904 [CRITICAL] safe-eval vulnerable to Prototype Pollution
safe-eval vulnerable to Prototype Pollution
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.
GHSA
safe-eval vulnerable to Prototype Pollution
ghsa·2022-12-20
CVE-2022-25904 [CRITICAL] CWE-1321 safe-eval vulnerable to Prototype Pollution
safe-eval vulnerable to Prototype Pollution
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-12-20
Published