Description
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Remediation
References
https://github.com/substack/static-eval/pull/18
https://maustin.net/articles/2017-10/static_eval
https://nodesecurity.io/advisories/548
Related Vulnerabilities
CVE-2021-21118 Vulnerability in npm package electron
CVE-2023-31579 Vulnerability in maven package top.tangyh.basic:lamp-util
CVE-2022-4772 Vulnerability in maven package com.github.dgarijo:widoco
CVE-2022-31108 Vulnerability in maven package org.webjars.npm:mermaid
CVE-2021-21363 Vulnerability in maven package io.swagger:swagger-generator