This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878.
Versions of notevil are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload try{a[b];}catch(e){e.constructor.constructor('return proto.arguments.callee.proto.polluted=true')()} add the polluted property to Function.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in notevil.