CVE-2017-16088
highpriority · attend · 51EPSS 0.034 · 89 %ileexploit · PoCEUUSEPSS · scored 2026-10-22
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9.4–10
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- Flyy-yu/CVE-2017-16088Exploit CVE-2017-16088 PoC · poc_in_github
affected products (6)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-ww6v-677g-p656Sandbox Breakout in safe-eval2018-07-18ghsa · osvUS
Affected versions of `safe-eval` are vulnerable to a sandbox escape. By accessing object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox. ## Proof of Concept: This code accesses the process object and calls `.exit()` ```js var safeEval = require('safe-eval'); safeEval("this.constructor.constructor('return process')().exit()"); ``` ## Recommendation Update to version 0.4.0 or later
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- https://github.com/hacksparrow/safe-eval/issues/5cnnvd
- https://github.com/patriksimek/vm2/issues/59cnnvd
- https://nodesecurity.io/advisories/337cnnvd
- https://github.com/hacksparrow/safe-eval/issues/5enisa_euvd
- https://github.com/patriksimek/vm2/issues/59enisa_euvd
- https://nodesecurity.io/advisories/337enisa_euvd
- https://github.com/hacksparrow/safe-eval/issues/5Third Party Advisorynvd
- https://github.com/patriksimek/vm2/issues/59Third Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan