CVE-2019-10759
Sandbox Breakout / Arbitrary Code Execution in safer-eval
CVE-2019-10759 is a critical vulnerability (CVSS 9.9) in Safer-eval Project Safer-eval, published October 15, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. Fixed in safer-eval 1.3.4.
- Severity
- 9.9 CriticalCVSS 3.1, NVD
- Exploit chance
- 1.79%EPSS, 78th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.3.4safer-eval
Description
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
safer-evalnpm | before 1.3.4 | 1.3.4 |
What each source reports
NVD Score used
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
- Record
CVE-2019-10759- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
- Record
CVE-2019-10759- Updated
- 2026-11-02
EUVDEUVD-2019-0712No score
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
- Record
EUVD-2019-0712- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r3x4-wr4h-pw33
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Versions of safer-eval prior to 1.3.4 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. For example, evaluating he string console.constructor.constructor('return process')().env prints process.env to the console.
Recommendation
Upgrade to version 1.3.4 or later.
- Record
GHSA-r3x4-wr4h-pw33- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
- Record
CVE-2019-10759- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-r3x4-wr4h-pw33
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Versions of safer-eval prior to 1.3.4 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. For example, evaluating he string console.constructor.constructor('return process')().env prints process.env to the console.
Recommendation
Upgrade to version 1.3.4 or later.
- Record
GHSA-r3x4-wr4h-pw33- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.