GHSA-6jg8-7333-554w
GHSA-6jg8-7333-554w · Sandbox Breakout in realms-shim
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code. ## Recommendation Upgrade to version 1.2.0 or later.
CVSS 9.8 · Critical · Fix available
- Published
- Updated
Stack: node
Affected products and versions
realms-shim npm
- Affected ranges
- SEMVER: < 1.2.0
Update to 1.2.0
ses npm
- Affected ranges
- SEMVER: < 0.6.3
Update to 0.6.3
Original sources
- https://github.com/Agoric/realms-shim/security/advisories/GHSA-6jg8-7333-554w
- https://github.com/Agoric/realms-shim
- https://github.com/advisories/GHSA-6jg8-7333-554w
- https://snyk.io/vuln/SNYK-JS-REALMSSHIM-471680
- https://www.npmjs.com/advisories/1180
- https://www.npmjs.com/advisories/1181
- https://www.npmjs.com/advisories/1182
- https://www.npmjs.com/advisories/1190
- https://www.npmjs.com/advisories/1191
- https://osv.dev/vulnerability/GHSA-6jg8-7333-554w