Description
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Remediation
References
https://github.com/substack/static-eval/pull/18
https://maustin.net/articles/2017-10/static_eval
https://nodesecurity.io/advisories/548
Related Vulnerabilities
CVE-2022-39387 Vulnerability in maven package org.xwiki.contrib.oidc:oidc-authenticator
CVE-2017-5653 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-xml
CVE-2021-23411 Vulnerability in npm package anchorme
CVE-2024-36401 Vulnerability in maven package org.geoserver.web:gs-web-app
CVE-2021-41084 Vulnerability in maven package org.http4s:http4s-server_3