GitHub Advisoryadvisory · crates.io

GHSA-4mw5-2636-4535 op_panic in the base runtime can force a panic in the runtime's containing thread

MEDIUM Published 2024-12-04 Modified 2024-12-04 Official page ↗
Ecosystem
crates.io
Packages
js-sandbox
Severity
Moderate
Reviewed
2024-12-04

Affected packages

• crates.io js-sandbox: <= 0.1.6 (no fix yet)

Description

Affected versions use deno_core releases that expose `Deno.core.ops.op_panic` to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing It can be fixed by stubbing out the exposed op: ```javascript Deno.core.ops.op_panic = (msg) => { throw new Error(msg) }; ```

References