Description
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
Remediation
References
https://nodesecurity.io/advisories/548
https://maustin.net/articles/2017-10/static_eval
https://github.com/substack/static-eval/pull/18
Related Vulnerabilities
CVE-2021-21172 Vulnerability in maven package org.webjars.npm:electron
CVE-2022-27772 Vulnerability in maven package org.springframework.boot:spring-boot
CVE-2022-0355 Vulnerability in npm package simple-get
CVE-2019-10795 Vulnerability in maven package org.webjars.npm:undefsafe
CVE-2022-45384 Vulnerability in maven package org.jenkins-ci.plugins:reverse-proxy-auth-plugin