CVE-2022-25904 HIGH

CVE-2022-25904: Prototype Pollution

Vendor N/A
Product safe-eval
Published December 21, 2022
Last update April 16, 2025

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

What the vulnerability does

01Description

All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.

Key dates

02Disclosure timeline

December 21, 2022 CVE published
April 16, 2025 Record updated