Skip to content

Commit 26665e9

Browse files
authored
Added warning
1 parent e5999a3 commit 26665e9

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@
44

55
`safe-eval` `0.3.0` and below are affected by a sandbox breakout vulnerability - [NSP 337](https://nodesecurity.io/advisories/337), [CVE-2017-16088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16088).
66

7-
Version `0.4.0` fixes this vulnerability. It is highly recommended to upgrade to the latest version if you are using `safe-eval` for executing code not generated by yourself. Thanks @kauegimenes for the patch.
7+
Version `0.4.0` fixes this vulnerability. It is highly recommended to upgrade to the latest version if you are using `safe-eval` for executing code not generated by yourself. Thanks [@kauegimenes](https://github.com/kauegimenes) for the patch.
8+
9+
_UPDATE 27/08/2018:_ There are still ways to crash the Node process, please use `safe-eval` only with content created by yourself or from trusted sources. User-submitted data should not be run through `safe-eval`. Thanks [@cpcallen](https://github.com/cpcallen) for the report.
810

911
## What is this?
1012

0 commit comments

Comments
 (0)