Sandbox Breakout / Arbitrary Code Execution in safer-eval
Summary
GHSA-69p9-9qm9-h447: Sandbox Breakout / Arbitrary Code Execution in safer-eval. Affects safer-eval versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The safer-eval package is an npm package that provides a sandboxed environment for evaluating JavaScript code. It is commonly used to execute user-supplied code in a controlled manner. The package aims to prevent malicious code from causing harm by restricting access to sensitive resources and providing a secure execution environment. However, a vulnerability has been discovered in safer-eval that allows for sandbox breakout and arbitrary code execution.
Vulnerability Detail
The vulnerability in safer-eval allows an attacker to break out of the sandbox and execute arbitrary code. This can lead to various security risks, such as unauthorized access to sensitive data, remote code execution, and privilege escalation. The vulnerability arises from a flaw in the sandboxing mechanism of the package, which fails to properly restrict access to resources and prevent code execution outside the intended environment.
How To Fix
Latest published version: 1.3.6 as of 23 Oct 2026
npm install safer-eval@1.3.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
npm install safer-eval@1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the safer-eval package to the fixed version to mitigate the risk of sandbox breakout and arbitrary code execution.
Conclusion
The vulnerability in safer-eval exposes applications to the risk of sandbox breakout and arbitrary code execution. To mitigate this risk, it is essential to update the safer-eval package to version 1.3.2 or later. This update includes a fix for the vulnerability and ensures that code execution remains confined within the intended sandboxed environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for safer-eval →
FAQ
safer-eval is an npm package that provides a sandboxed environment for evaluating JavaScript code. It is commonly used to execute user-supplied code in a controlled manner.
Sandbox breakout refers to the ability of an attacker to escape the restricted environment of a sandbox and execute code outside of its intended boundaries. In the case of safer-eval, this vulnerability allows an attacker to break out of the sandbox and execute arbitrary code.
The vulnerability in safer-eval can lead to various security risks, including unauthorized access to sensitive data, remote code execution, and privilege escalation. It allows an attacker to execute arbitrary code outside of the intended sandboxed environment.
Yes, a fix for this vulnerability is available in version 1.3.2 of the safer-eval package. It is recommended to update to this version or later to mitigate the risk of sandbox breakout and arbitrary code execution.
There is no known workaround for this vulnerability. It is crucial to update the safer-eval package to the fixed version to mitigate the risk of sandbox breakout and arbitrary code execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for safer-eval.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
