GHSA-6jg8-7333-554w
GHSA-6jg8-7333-554w · Sandbox Breakout in realms-shim
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code. ## Recommendation Upgrade to version 1.2.0 or later.
CVSS 9.8 · Crítica · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
realms-shim npm
- Intervalos de versiones afectados
- SEMVER: < 1.2.0
Actualiza a 1.2.0
ses npm
- Intervalos de versiones afectados
- SEMVER: < 0.6.3
Actualiza a 0.6.3
Fuentes originales
- https://github.com/Agoric/realms-shim/security/advisories/GHSA-6jg8-7333-554w
- https://github.com/Agoric/realms-shim
- https://github.com/advisories/GHSA-6jg8-7333-554w
- https://snyk.io/vuln/SNYK-JS-REALMSSHIM-471680
- https://www.npmjs.com/advisories/1180
- https://www.npmjs.com/advisories/1181
- https://www.npmjs.com/advisories/1182
- https://www.npmjs.com/advisories/1190
- https://www.npmjs.com/advisories/1191
- https://osv.dev/vulnerability/GHSA-6jg8-7333-554w