{"id":"CVE-2017-16088","aliases":["GHSA-ww6v-677g-p656"],"url":"https://o3.security/vulnerability/CVE-2017-16088","summary":"Sandbox Breakout in safe-eval","details":"Affected versions of `safe-eval` are vulnerable to a sandbox escape. By accessing object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox. \n\n## Proof of Concept:\nThis code accesses the process object and calls `.exit()`\n```js\nvar safeEval = require('safe-eval');\nsafeEval(\"this.constructor.constructor('return process')().exit()\");\n```\n\n\n## Recommendation\n\nUpdate to version 0.4.0 or later","published":"2018-06-07T02:29:01.643Z","modified":"2026-10-20T10:48:16.377664544Z","cvss":{"score":10,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"safe-eval","fixedVersion":null}],"fix":{"url":"https://github.com/hacksparrow/safe-eval/pull/13","label":"hacksparrow/safe-eval#13"},"references":[{"type":"ADVISORY","url":"https://github.com/hacksparrow/safe-eval/issues/5"},{"type":"ADVISORY","url":"https://github.com/patriksimek/vm2/issues/59"},{"type":"ADVISORY","url":"https://nodesecurity.io/advisories/337"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16088"},{"type":"WEB","url":"https://github.com/hacksparrow/safe-eval/pull/13"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-ww6v-677g-p656"},{"type":"WEB","url":"https://www.npmjs.com/advisories/337"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T10:48:16.377664544Z"}}