WS-2020-0002 (Medium) detected in safer-eval-1.3.5.tgz

[mend-bolt-for-github]

WS-2020-0002 - Medium Severity Vulnerability

Vulnerable Library - safer-eval-1.3.5.tgz

a safer eval

Library home page: https://registry.npmjs.org/safer-eval/-/safer-eval-1.3.5.tgz

Path to dependency file: /tmp/ws-scm/infinite/package.json

Path to vulnerable library: /tmp/ws-scm/infinite/node_modules/safer-eval/package.json

Dependency Hierarchy:

• parcel-bundler-1.11.0.tgz (Root Library)
  • serialize-to-js-1.2.2.tgz
    • ❌ safer-eval-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: f686a0f9119ce1b31715bd19e5a2f4705af80098

Vulnerability Details

Arbitrary Code Execution vulnerability found in safer-eval versions 1.x through 1.3.6. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system.

Publish Date: 2020-01-08

URL: WS-2020-0002

CVSS 2 Score Details (5.0)

Base Score Metrics not available

---

Step up your Open Source Security Game with WhiteSource here