CVE-2023-26122
Published: 11 April 2023
Summary
CVE-2023-26122 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Safe-Eval Project Safe-Eval. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The package safe-eval is affected by CVE-2023-26122, a sandbox bypass vulnerability present in all versions due to improper input sanitization stemming from prototype pollution. This issue impacts functions including __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), and valueOf(), and carries a CVSS score of 8.8.
An attacker with low privileges can exploit the vulnerability over the network without user interaction to achieve remote code execution by bypassing the intended sandbox restrictions.
The EPSS score for this CVE stands at 0.0808 with no increase from its peak value. References point to GitHub issues and a gist detailing the problem.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1223
Vulnerability details
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulnerable functions:** __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(),…
more
valueOf().
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.