Sandbox Breakout / Prototype Pollution in notevil
Summary
GHSA-9gxr-rhx6-4jgv: Sandbox Breakout / Prototype Pollution in notevil. Affects notevil versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The notevil package is an open-source JavaScript library that provides a sandbox environment for executing untrusted code. It is commonly used for evaluating user-supplied expressions or scripts in a controlled manner. The package aims to prevent malicious code from accessing sensitive resources or modifying the global context. However, versions prior to 1.3.3 are vulnerable to a Sandbox Escape leading to Prototype Pollution.
Vulnerability Detail
The vulnerability in notevil arises from a failure to restrict access to the main context, allowing an attacker to add or modify an object's prototype. This can lead to Prototype Pollution, a type of vulnerability where an attacker can modify the behavior of existing objects or introduce new properties into the prototype chain. By exploiting this vulnerability, an attacker can execute arbitrary code within the sandboxed environment and potentially gain unauthorized access to sensitive resources or manipulate the behavior of the application.
How To Fix
Minimum fixed version
1.3.3
This is the first release that contains the fix.
npm install notevil@1.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the notevil package to address the security issues effectively.
Conclusion
The Sandbox Breakout / Prototype Pollution vulnerability in notevil can have severe consequences, allowing attackers to execute arbitrary code within the sandboxed environment. It is crucial for developers to upgrade to version 1.3.3 or later to mitigate these security risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notevil →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the behavior of existing objects or introduce new properties into the prototype chain. This can lead to unexpected behavior, security bypasses, or remote code execution.
The Sandbox Escape in notevil occurs due to a failure to restrict access to the main context. This allows an attacker to add or modify an object's prototype, leading to potential Prototype Pollution and the ability to execute arbitrary code within the sandboxed environment.
Exploiting this vulnerability can allow an attacker to execute arbitrary code within the sandboxed environment, potentially leading to unauthorized access to sensitive resources, manipulation of application behavior, or even remote code execution.
No, only versions prior to 1.3.3 are vulnerable to this Sandbox Escape and Prototype Pollution issue. It is crucial to upgrade to version 1.3.3 or later to mitigate the security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for notevil.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
