GHSA-6jg8-7333-554w
GHSA-6jg8-7333-554w · Sandbox Breakout in realms-shim
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code. ## Recommendation Upgrade to version 1.2.0 or later.
CVSS 9.8 · Critique · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
realms-shim npm
- Plages de versions concernées
- SEMVER: < 1.2.0
Mettez à jour vers 1.2.0
ses npm
- Plages de versions concernées
- SEMVER: < 0.6.3
Mettez à jour vers 0.6.3
Sources originales
- https://github.com/Agoric/realms-shim/security/advisories/GHSA-6jg8-7333-554w
- https://github.com/Agoric/realms-shim
- https://github.com/advisories/GHSA-6jg8-7333-554w
- https://snyk.io/vuln/SNYK-JS-REALMSSHIM-471680
- https://www.npmjs.com/advisories/1180
- https://www.npmjs.com/advisories/1181
- https://www.npmjs.com/advisories/1182
- https://www.npmjs.com/advisories/1190
- https://www.npmjs.com/advisories/1191
- https://osv.dev/vulnerability/GHSA-6jg8-7333-554w