Description
npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
Problem types
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Product status
References
www.npmjs.com/package/expr-eval-fork
github.com/silentmatt/expr-eval
github.com/jorenbroekema/expr-eval
www.huntr.dev/bounties/1-npm-expr-eval/
github.com/...lob/main/jeopardy/web/babybox/solver/solver.py
github.com/silentmatt/expr-eval/pull/252/files
github.com/...5af300fd74a01b46fab2102990ff1c14d/expr-eval.py
