GitHub Advisoryadvisory · crates.io

GHSA-fwfx-rrv8-crpf op_panic in the base runtime can force a panic in the runtime's containing thread

MEDIUM Published 2024-12-04 Modified 2024-12-04 Official page ↗
Ecosystem
crates.io
Packages
rustyscript
Severity
Moderate
Reviewed
2024-12-04

Affected packages

• crates.io rustyscript: >= 0.4.0, < 0.6.1 → fixed in 0.6.1

Description

Affected versions use deno_core releases that expose `Deno.core.ops.op_panic` to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime. It can be fixed by stubbing out the exposed op: ```javascript Deno.core.ops.op_panic = (msg) => { throw new Error(msg) }; ```

References