{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T10:19:14.036","vulnerabilities":[{"cve":{"id":"CVE-2017-16226","sourceIdentifier":"support@hackerone.com","published":"2018-06-07T02:29:07.800","lastModified":"2026-06-17T01:09:00.570","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution."},{"lang":"es","value":"El módulo static-eval está diseñado para evaluar expresiones analizables de forma estática. En las versiones afectadas, las entradas de usuario no fiables pueden acceder al constructor de función global, lo que permitiría la ejecución de código arbitrario."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"HackerOne","product":"static-eval node module node module","versions":[{"version":"<=1.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:static-eval_project:static-eval:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.0.0","matchCriteriaId":"279E9C4A-4AB5-48D2-9693-FC2E165B9F81"}]}]}],"references":[{"url":"https://github.com/substack/static-eval/pull/18","source":"support@hackerone.com","tags":["Patch","Third Party Advisory"]},{"url":"https://maustin.net/articles/2017-10/static_eval","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://nodesecurity.io/advisories/548","source":"support@hackerone.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/substack/static-eval/pull/18","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://maustin.net/articles/2017-10/static_eval","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://nodesecurity.io/advisories/548","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}