CVE-2023-26121 identifies a Prototype Pollution vulnerability within the safe-eval package. This flaw allows attackers to inject malicious properties into the global Object.prototype, impacting all objects in the JavaScript environment. Versions of safe-eval prior to 0.4.2 are affected. Applying an upgrade to a patched version is the recommended remediation.
影響と攻撃シナリオ翻訳中…
Prototype Pollution vulnerabilities, like CVE-2023-26121, can have severe consequences. An attacker exploiting this flaw can modify the behavior of existing JavaScript code by injecting properties into Object.prototype. This can lead to unexpected application behavior, data corruption, and, in some cases, Remote Code Execution (RCE). The safeEval function, specifically, is vulnerable due to insufficient sanitization of input parameters. Successful exploitation could allow an attacker to bypass security controls, escalate privileges, or compromise the entire application.
悪用の状況翻訳中…
CVE-2023-26121 was published on April 11, 2023. There is currently no indication of active exploitation in the wild, but the vulnerability's critical severity and ease of exploitation warrant immediate attention. The vulnerability is not listed on KEV or EPSS, indicating a low to medium probability of exploitation. Public Proof-of-Concept (POC) code is likely to emerge given the vulnerability's nature and severity.
脅威インテリジェンス
エクスプロイト状況
EPSS
0.10% (28% パーセンタイル)
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- なし — 認証不要。資格情報なしで悪用可能。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化あり — 攻撃が脆弱なコンポーネントを超えて他のシステムに波及可能。
- Confidentiality
- 高 — 機密性の完全喪失。全データが読み取り可能。
- Integrity
- 高 — 任意のデータの書き込み・変更・削除が可能。
- Availability
- 高 — 完全なクラッシュまたはリソース枯渇。完全なサービス拒否。
影響を受けるソフトウェア
タイムライン
- 公開日
- 更新日
- EPSS 更新日
緩和策と回避策翻訳中…
The primary mitigation for CVE-2023-26121 is to upgrade to version 0.4.3 or later of the safe-eval package. If upgrading is not immediately feasible, consider implementing input validation and sanitization on any data passed to the safeEval function. While a direct workaround is difficult, restricting the permissions of the application and employing a Web Application Firewall (WAF) with prototype pollution detection rules can help reduce the attack surface. Regularly scan dependencies for known vulnerabilities using tools like npm audit or yarn audit.
修正方法翻訳中…
公式パッチはありません。回避策を確認するか、アップデートを監視してください。
よくある質問翻訳中…
What is CVE-2023-26121 — Prototype Pollution in safe-eval?
CVE-2023-26121 is a critical Prototype Pollution vulnerability in the safe-eval package, affecting versions up to 0.4.2. It allows attackers to manipulate object properties, potentially leading to Remote Code Execution (RCE).
Am I affected by CVE-2023-26121 in safe-eval?
If your project uses safe-eval version 0.4.2 or earlier, you are vulnerable. Check your project's dependencies using npm list safe-eval or yarn list safe-eval.
How do I fix CVE-2023-26121 in safe-eval?
Upgrade to version 0.4.3 or later of the safe-eval package. Use npm install safe-eval@latest or yarn add safe-eval@latest to update.
Is CVE-2023-26121 being actively exploited?
There is currently no confirmed active exploitation in the wild, but the vulnerability's severity warrants immediate remediation to prevent potential attacks.
Where can I find the official safe-eval advisory for CVE-2023-26121?
Refer to the package's advisory on the npm registry: [https://www.npmjs.com/advisories/1738](https://www.npmjs.com/advisories/1738)
今すぐ試す — アカウント不要
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
依存関係ファイルをドラッグ＆ドロップ
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...