VDB
Sign up
CRITICAL9.8

GHSA-6jg8-7333-554w

Sandbox Breakout in realms-shim

Quick fix

GHSA-6jg8-7333-554w — realms-shim: upgrade to the fixed version with the command below.

npm install realms-shim@1.2.0

Details

Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code.

## Recommendation

Upgrade to version 1.2.0 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/realms-shim
Introduced in: 0Fixed in: 1.2.0
Fixnpm install realms-shim@1.2.0
npm/ses
Introduced in: 0Fixed in: 0.6.3
Fixnpm install ses@0.6.3

References