LiveActive security incident?Get immediate response
CVE Record

CVE-2017-16088: The safe-eval module describes itself as a safer version of eval.

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2017-16088 affects the safe-eval Node.js module, marketed as a safer eval. The published description says unsanitized input can escape the intended sandbox and access the standard library. Business urgency depends on whether any application evaluates user-controlled input with this package.

Executive priority

Treat this as high priority if safe-eval is reachable from customers, partners, or unauthenticated users. If the package is present only in trusted internal tooling, prioritize inventory and removal during the next security maintenance cycle.

Technical view

The issue is a sandbox escape in safe-eval. By reaching object constructors, evaluated input can break out of the restricted context and access Node.js standard library functionality. The source bundle lists all versions of the safe-eval node module as affected, with no CVSS score provided.

Likely exposure

Exposure is likely in Node.js services or build tools that depend on safe-eval and pass untrusted or user-controlled strings into it. Applications using it only for trusted internal expressions have lower practical exposure, but should still replace or isolate it because all versions are listed as affected.

Exploitation context

The bundle does not show CISA KEV listing or active exploitation evidence. Public references describe the sandbox escape issue, but exploitation in a specific environment would require an application data path that feeds unsanitized input into safe-eval.

Researcher notes

Evidence is limited to the CVE description and referenced advisories/issues. No CVSS, patch version, or active exploitation signal is provided in the bundle. The key validation task is proving whether attacker-controlled input can reach safe-eval in deployed code.

Mitigation direction

  • Inventory direct and transitive dependencies for safe-eval.
  • Stop evaluating user-controlled input with safe-eval.
  • Remove or replace safe-eval where untrusted input is possible.
  • Check vendor and package advisory guidance before selecting a replacement.
  • Add input validation and deny unsafe expression features where removal is delayed.

Validation and detection

  • Search package manifests and lockfiles for safe-eval.
  • Map every safe-eval call site to its input source.
  • Confirm no public route or API passes user input into safe-eval.
  • Review runtime logs for unexpected expression evaluation paths.
  • Add regression tests covering unsafe user-controlled expression rejection.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-610: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2017-16088 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
HackerOnesafe-eval node moduleAll versionsListed
Weakness

CWE details

CWE-610

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-610 · source CWE mapping

Externally Controlled Reference to a Resource in Another Sphere

Externally Controlled Reference to a Resource in Another Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs