Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZqZzgtNzMzMy01NTR3

Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.0 are vulnerable to a Sandbox Breakout. Reflect.construct can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code.

Recommendation

Upgrade to version 1.2.0 or later.

Permalink: https://github.com/advisories/GHSA-6jg8-7333-554w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZqZzgtNzMzMy01NTR3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: about 2 years ago


CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-6jg8-7333-554w
References: Repository: https://github.com/Agoric/realms-shim
Blast Radius: 37.5

Affected Packages

npm:ses
Dependent packages: 304
Dependent repositories: 6,629
Downloads: 167,955 last month
Affected Version Ranges: < 0.6.3
Fixed in: 0.6.3
All affected versions: 0.0.0, 0.0.1, 0.1.2, 0.1.3, 0.2.0, 0.3.0, 0.4.0, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.6.0, 0.6.1, 0.6.2
All unaffected versions: 0.6.3, 0.6.4, 0.6.5, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.11.0, 0.11.1, 0.12.0, 0.12.1, 0.12.2, 0.12.3, 0.12.4, 0.12.5, 0.12.6, 0.12.7, 0.13.0, 0.13.1, 0.13.2, 0.13.3, 0.13.4, 0.13.5, 0.14.0, 0.14.1, 0.14.2, 0.14.3, 0.14.4, 0.14.5, 0.15.0, 0.15.1, 0.15.2, 0.15.3, 0.15.4, 0.15.5, 0.15.6, 0.15.7, 0.15.8, 0.15.9, 0.15.10, 0.15.11, 0.15.12, 0.15.13, 0.15.14, 0.15.15, 0.15.16, 0.15.17, 0.15.18, 0.15.19, 0.15.20, 0.15.21, 0.15.22, 0.15.23, 0.15.24, 0.16.0, 0.16.1, 0.17.0, 0.17.1, 0.18.0, 0.18.1, 0.18.2, 0.18.3, 0.18.4, 0.18.5, 0.18.7, 0.18.8, 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.4.1, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.9.1, 1.10.0
npm:realms-shim
Dependent packages: 5
Dependent repositories: 62
Downloads: 103 last month
Affected Version Ranges: < 1.2.0
Fixed in: 1.2.0
All affected versions: 1.1.0, 1.1.1, 1.1.2
All unaffected versions: 1.2.0, 1.2.1, 1.2.2