Cyber Resilience

CVE-2023-26122

HighPublic PoC

Published: 11 April 2023

Published
11 April 2023
Modified
07 February 2025
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0808 92.3th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-26122 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Safe-Eval Project Safe-Eval. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The package safe-eval is affected by CVE-2023-26122, a sandbox bypass vulnerability present in all versions due to improper input sanitization stemming from prototype pollution. This issue impacts functions including __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), and valueOf(), and carries a CVSS score of 8.8.

An attacker with low privileges can exploit the vulnerability over the network without user interaction to achieve remote code execution by bypassing the intended sandbox restrictions.

The EPSS score for this CVE stands at 0.0808 with no increase from its peak value. References point to GitHub issues and a gist detailing the problem.

EU & UK References

Vulnerability details

All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulnerable functions:** __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(),…

more

valueOf().

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

safe-eval project
safe-eval
≤ 0.4.1

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References