Homepage
About Snyk

notevil@1.3.3 vulnerabilities

Evalulate javascript like the built-in eval() method but safely

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the notevil package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Sandbox Bypass

notevil is a module uses esprima to parse the javascript AST then walks each node and evaluates the result **Note:**This package has been deprecated.

Affected versions of this package are vulnerable to Sandbox Bypass. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype.

Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878.

How to fix Sandbox Bypass?

There is no fixed version for notevil.

*
Go back to all versions of this package