Description
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Remediation
References
https://github.com/substack/static-eval/pull/18
https://maustin.net/articles/2017-10/static_eval
https://nodesecurity.io/advisories/548
Related Vulnerabilities
CVE-2020-11971 Vulnerability in maven package org.apache.camel:camel-core
CVE-2021-21141 Vulnerability in npm package electron
CVE-2023-33201 Vulnerability in maven package org.bouncycastle:bcprov-debug-jdk14
CVE-2018-12691 Vulnerability in maven package org.onosproject:onos-apps-acl
CVE-2016-0791 Vulnerability in maven package org.jenkins-ci.main:jenkins-core