Code: test_js (void) {
    GString *result = g_string_new("");

    /* simple javascript can be evaluated and returned */
     parse_cmd_line("js ('x' + 345).toUpperCase()", result);
     g_assert_cmpstr("X345", ==, result->str);
 
    /* uzbl commands can be run from javascript */
    uzbl.net.useragent = "Test useragent";
    parse_cmd_line("js Uzbl.run('print @useragent').toUpperCase();", result);
    g_assert_cmpstr("TEST USERAGENT", ==, result->str);
     g_string_free(result, TRUE);
 }

Vulnerability Type: Exec Code 
CWE ID: CWE-264
Summary: The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.
Commit Message: disable Uzbl javascript object because of security problem.