Description
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Remediation
References
https://github.com/substack/static-eval/pull/18
https://maustin.net/articles/2017-10/static_eval
https://nodesecurity.io/advisories/548
Related Vulnerabilities
CVE-2020-28503 Vulnerability in maven package org.webjars.npm:copy-props
CVE-2022-43183 Vulnerability in maven package com.xuxueli:xxl-job
CVE-2023-35151 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rest-server
CVE-2019-10061 Vulnerability in npm package opencv
CVE-2022-29577 Vulnerability in maven package org.owasp.antisamy:antisamy