GitHub Advisoryadvisory · npm

GHSA-7cg8-pq9v-x98q Sandbox Breakout in realms-shim

CRITICAL Published 2019-10-21 Modified 2021-09-02 Official page ↗
Ecosystem
npm
Packages
realms-shim
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reviewed
2020-06-16

Affected packages

• npm realms-shim: < 1.2.1 → fixed in 1.2.1

Description

Versions of `realms-shim` prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting function. Confined code which used the evaluator itself could provide a malicious rewriter function that captured this object, and use it to breach the sandbox. Recommendation Upgrade to version 1.2.1 or later.

References