https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 11:33:18 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-14441 cnvd-2018-14441 https://cve.radiocsirt.org/vuln/cnvd-2018-14441 https://cve.radiocsirt.org/vuln/euvd-2026-164326 EUVD-2026-164326 https://cve.radiocsirt.org/vuln/euvd-2026-164326 https://cve.radiocsirt.org/vuln/fkie_cve-2017-16226 <p>The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.</p> <p>The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-16226 https://cve.radiocsirt.org/vuln/ghsa-5mjw-6jrh-hvfq <p><strong>Affected:</strong> npm: static-eval</p> <p>Affected versions of `static-eval` pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.</p> <p>## Proof of concept ```js var evaluate = require(&#39;static-eval&#39;); var parse = require(&#39;esprima&#39;).parse; var src = &#39;(function(){console.log(process.pid)})()&#39;; var ast = parse(src).body[0].expression; var res = evaluate(ast, {}); // Will print the process id ```</p> <p>## Recommendation</p> <p>Update to version 2.0.0 or later.</p> <p><strong>Affected:</strong> npm: static-eval</p> <p>Affected versions of `static-eval` pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.</p> <p>## Proof of concept ```js var evaluate = require(&#39;static-eval&#39;); var parse = require(&#39;esprima&#39;).parse; var src = &#39;(function(){console.log(process.pid)})()&#39;; var ast = parse(src).body[0].expression; var res = evaluate(ast, {}); // Will print the process id ```</p> <p>## Recommendation</p> <p>Update to version 2.0.0 or later.</p> https://cve.radiocsirt.org/vuln/ghsa-5mjw-6jrh-hvfq https://cve.radiocsirt.org/vuln/gsd-2017-16226 gsd-2017-16226 https://cve.radiocsirt.org/vuln/gsd-2017-16226