Description
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Remediation
References
https://github.com/substack/static-eval/pull/18
https://maustin.net/articles/2017-10/static_eval
https://nodesecurity.io/advisories/548
Related Vulnerabilities
CVE-2021-26814 Vulnerability in npm package wazuh
CVE-2022-35923 Vulnerability in npm package v8n
CVE-2020-14062 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2021-20289 Vulnerability in maven package org.jboss.resteasy:resteasy-core
CVE-2021-44145 Vulnerability in maven package org.apache.nifi:nifi