Safer-eval is a JavaScript library designed to provide a sandboxed environment for executing code snippets, mitigating the security risks associated with the native eval() function. Version 1.3.6 introduces subtle but potentially impactful changes compared to its predecessor, version 1.3.5. Both versions share the same core dependencies, including "clones" for deep copying, ensuring that the evaluated code doesn't inadvertently modify the external scope. They also rely on a robust suite of devDependencies for testing, linting, and building, indicating a commitment to code quality and maintainability. These include tools like Mocha, Karma, ESLint, and Webpack, ensuring code integrity and browser compatibility.
The primary difference lies in the dist metadata. Version 1.3.6 showcases a slightly smaller fileCount (10 vs 11) but a larger unpackedSize (54474 vs 46073 bytes) suggesting an optimization or refactoring that might have consolidated files while potentially increasing the overall codebase size. This could hint at improved performance or added features. Furthermore, the release date indicates a significant gap between the two versions, with 1.3.6 being released several months after 1.3.5 potentially incorporating bug fixes, security patches, or minor feature enhancements addressing issues discovered in the previous iteration. Developers should review the changelog (if available) or commit history on the GitHub repository to understand the specific differences and determine if the update warrants integration into their project. The change in the description to "harmful as eval" might be interpreted as a hint towards the intended use of the package for potentially harmful code, which will be isolated.
All the vulnerabilities related to the version 1.3.6 of the package
Sandbox Breakout / Arbitrary Code Execution in safer-eval
All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system.
The package is not suited to receive arbitrary user input. Consider using an alternative package.
Sandbox Breakout / Arbitrary Code Execution in safer-eval
All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input. This may allow attackers to execute arbitrary code in the system.
The package is not meant to receive user input. Consider using an alternative package until a fix is made available.
