Description
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Remediation
References
https://github.com/substack/static-eval/pull/18
https://maustin.net/articles/2017-10/static_eval
https://nodesecurity.io/advisories/548
Related Vulnerabilities
CVE-2021-23371 Vulnerability in npm package chrono-node
CVE-2019-10908 Vulnerability in maven package org.airsonic.player:airsonic-main
CVE-2021-23353 Vulnerability in maven package org.webjars.bowergithub.mrrio:jspdf
CVE-2021-22964 Vulnerability in npm package fastify-static
CVE-2022-24819 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates