Non évaluée
Prototype Pollution
CVE-2022-25904
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web security.snyk.io