CVE-2017-16226

The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.

Score

CVSS 3.0 9.8 Critical

Status

Modified - support@hackerone.com

Published

2018-06-07

Last modified

2024-09-16

Weaknesses

CWE-20

Affected products

• Static-eval Node Module Node Module (Hackerone)
• Static-eval (Static-eval Project)

References

• https://github.com/substack/static-eval/pull/18
• https://maustin.net/articles/2017-10/static_eval
• https://nodesecurity.io/advisories/548