cve/2023/CVE-2023-26122.md

### [CVE-2023-26122](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26122)
![](https://img.shields.io/static/v1?label=Product&message=safe-eval&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%20*%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Sandbox%20Bypass&color=brighgreen)

### Description

All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation.
Exploiting this vulnerability might result in remote code execution ("RCE").

**Vulnerable functions:**

__defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(),  valueOf().

### POC

#### Reference
- https://github.com/hacksparrow/safe-eval/issues/27
- https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064

#### Github
- https://github.com/exoad/ProgrammingDisc