GitHub Advisoryadvisory · crates.io
GHSA-fwfx-rrv8-crpf op_panic in the base runtime can force a panic in the runtime's containing thread
MEDIUM
Official page ↗
- Ecosystem
- crates.io
- Packages
- rustyscript
- Severity
- Moderate
- Reviewed
- 2024-12-04
Affected packages
• crates.io rustyscript: >= 0.4.0, < 0.6.1 → fixed in 0.6.1
Description
Affected versions use deno_core releases that expose `Deno.core.ops.op_panic` to the JS runtime in the base core
This function when called triggers a manual panic in the thread containing the runtime.
It can be fixed by stubbing out the exposed op:
```javascript
Deno.core.ops.op_panic = (msg) => { throw new Error(msg) };
```