cve/2017/CVE-2017-16088.md

### [CVE-2017-16088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16088)
![](https://img.shields.io/static/v1?label=Product&message=safe-eval%20node%20module&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Externally%20Controlled%20Reference%20to%20a%20Resource%20in%20Another%20Sphere%20(CWE-610)&color=brighgreen)

### Description

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.

### POC

#### Reference
- https://github.com/hacksparrow/safe-eval/issues/5

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Flyy-yu/CVE-2017-16088
- https://github.com/hacksparrow/safe-eval