-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| expr-eval | npm | <= 2.0.2 | |
| expr-eval-fork | npm | < 2.0.2 | 2.0.2 |
Miggo AIRoot Cause AnalysisThe analysis of the provided security patches for the 'expr-eval' package clearly indicates that the 'evaluate' function in 'src/evaluate.js' is the source of the prototype pollution vulnerability. Both commits, '6e889e0e75c50ac37d70c35388602025650e0c50' and '6c475a118643ae0efe012de283e932fb8b74324b', apply the same fix. The patch adds a crucial security check that inspects parts of the expression (specifically, identifiers or 'IVAR' tokens) for keywords commonly used in prototype pollution attacks ('proto', 'prototype', 'constructor'). By throwing an error when these keywords are detected, the patch prevents the malicious manipulation of object prototypes. Therefore, any runtime profile during the exploitation of this vulnerability would show the 'evaluate' function as the primary function processing the malicious input.
evaluatesrc/evaluate.js
JavaScriptJavaScriptOngoing coverage of React2Shell