CVE-2017-16226

Published: Jun 7, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.

Affected (1)

Products: Static Eval Project: Static Eval

Static Eval Project

1 product

Static Eval

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Static Eval Project Static Eval	Before 2.0.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

https://github.com/substack/static-eval/pull/18

Source: support@hackerone.com

PatchThird Party Advisory

https://maustin.net/articles/2017-10/static_eval

Source: support@hackerone.com

Third Party Advisory

https://nodesecurity.io/advisories/548

Source: support@hackerone.com

ExploitThird Party Advisory

https://github.com/substack/static-eval/pull/18

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://maustin.net/articles/2017-10/static_eval

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://nodesecurity.io/advisories/548

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.