Sandbox Breakout / Arbitrary Code Execution in veval
Summary
GHSA-54qm-37qr-w5wq: Sandbox Breakout / Arbitrary Code Execution in veval. Affects veval versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
veval is an npm package that provides a sandboxed environment for evaluating JavaScript code. It is commonly used to execute user-provided code in a controlled manner. However, all versions of veval are vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. The package fails to restrict access to the main context through this.constructor.constructor, allowing attackers to execute arbitrary code in the system. By evaluating the payload this.constructor.constructor('return process.env')(), an attacker can print the contents of process.env.
Vulnerability Detail
The Sandbox Escape vulnerability in veval allows attackers to break out of the sandboxed environment and execute arbitrary code in the system. This can have severe consequences, as it enables attackers to access sensitive information, modify system configurations, or perform unauthorized actions. The vulnerability arises from the package's failure to properly restrict access to the main context, providing an avenue for attackers to execute malicious code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available at the moment, a possible workaround is to avoid using the veval package and switch to an alternative that does not have this vulnerability. By replacing the usage of veval with a safer alternative, the risk of sandbox breakout and arbitrary code execution can be mitigated. Here's an example of how to replace veval with a safer package:
// Replace veval with safer-alternative
const saferAlternative = require('safer-alternative');
// Evaluate code using safer-alternative
const result = saferAlternative.evaluate(code);
Conclusion
The veval package is vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. Currently, there is no fix available for this vulnerability. It is recommended to consider using an alternative package and monitoring security advisories for updates. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for veval →
FAQ
veval is an npm package that provides a sandboxed environment for evaluating JavaScript code. It allows executing user-provided code in a controlled manner.
The vulnerability allows attackers to break out of the sandboxed environment and execute arbitrary code in the system. This can lead to unauthorized access, data breaches, and system compromise.
No, currently there is no fix available for this vulnerability. It is recommended to use an alternative package until a fix is released.
To mitigate the risk, it is recommended to avoid using the veval package and switch to a safer alternative that does not have this vulnerability.
You can find more information about this vulnerability in the GitHub Security Advisory database. Monitoring security advisories and updates from the package maintainers is crucial to stay informed about any patches or fixes that may be released.
