GHSA-54qm-37qr-w5wq: 
JavaScript vulnerability analysis and mitigation

A critical security vulnerability was identified in all versions of the veval npm package (GHSA-54qm-37qr-w5wq). The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 4, 2020, and last updated on January 9, 2023. This security issue affects all versions of the package (>= 0.0.0) with no patched versions available (GitHub Advisory).

The vulnerability stems from the package's failure to properly restrict access to the main context through this.constructor.constructor. As a proof of concept, executing the payload this.constructor.constructor('return process.env')() allows access to the contents of process.env, demonstrating the breakdown of sandbox isolation (GitHub Advisory, NPM Advisory).

The vulnerability enables sandbox escape leading to Remote Code Execution (RCE), allowing attackers to execute arbitrary code within the system. This represents a critical security risk as it could potentially give attackers full access to the system running the vulnerable package (GitHub Advisory).

The vulnerability is considered to have Critical severity. A simple proof-of-concept exploit exists that demonstrates the ability to access system environment variables, indicating that exploitation is straightforward and requires minimal complexity (GitHub Advisory).

Currently, no fix is available for this vulnerability. The recommended mitigation strategy is to stop using the veval package and switch to an alternative package until a security fix is made available (GitHub Advisory).