CVE-2019-10760: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Summary
CVE-2019-10760: Sandbox Breakout / Arbitrary Code Execution in safer-eval. Affects safer-eval versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The safer-eval package is an npm package that provides a sandboxed environment for evaluating JavaScript code. It is designed to execute user-provided code in a restricted manner to prevent malicious activities. However, versions of safer-eval before 1.3.2 are vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. This vulnerability allows an attacker to execute arbitrary code outside the sandboxed environment, potentially compromising the system.
Vulnerability Detail
The vulnerability in safer-eval arises from a flaw in the handling of constructor properties. By exploiting this flaw, an attacker can craft a payload that escapes the sandbox and executes arbitrary code. This can result in unauthorized access, data breaches, and other malicious activities. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.9.
How To Fix
Latest published version: 1.3.6 as of 23 Oct 2026
npm install safer-eval@1.3.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
npm install safer-eval@1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The safer-eval package before version 1.3.2 is vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. It is crucial to upgrade to the fixed version to mitigate the risk of unauthorized code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for safer-eval →
FAQ
This vulnerability allows an attacker to execute arbitrary code outside the sandboxed environment, potentially leading to unauthorized access, data breaches, and other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the safer-eval package.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the recommended fix to prevent potential exploitation.
This vulnerability was discovered by the GitHub Security Lab.
References
Related vulnerabilities
Recent vulnerabilities recorded for safer-eval.
