GHSA-7cg8-pq9v-x98q
GHSA-7cg8-pq9v-x98q · Sandbox Breakout in realms-shim
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Versions of `realms-shim` prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting function. Confined code which used the evaluator itself could provide a malicious rewriter function that captured this object, and use it to breach the sandbox. ## Recommendation Upgrade to version 1.2.1 or later.
CVSS 9.8 · Critique · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
realms-shim npm
- Plages de versions concernées
- SEMVER: < 1.2.1
Mettez à jour vers 1.2.1