CVE-2017-16226

2018-04-2600:00:00

CWE-20

hackerone

www.cve.org

9.7 High

AI Score

Confidence

High

0.015 Low

EPSS

Percentile

87.1%

JSON

The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.

CNA Affected

[
  {
    "product": "static-eval node module node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<=1.1.1"
      }
    ]
  }
]