CVE-2022-25904

Name of the Vulnerable Software and Affected Versions safe-eval versions all

Description The issue allows an attacker to add or modify properties of the Object.prototype through Prototype Pollution when using the function safeEval. This is due to the function's use of the vm variable, enabling an attacker to modify properties of the Object.prototype.

Recommendations For all versions, consider disabling the use of the safeEval function until a patch is available to prevent exploitation. Restrict access to the vm variable to minimize the risk of modifying the Object.prototype properties.