Description
All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.3.1
References
Could your website be exposed too?
SmartScanner can check your website for Privilege Issues in jailed and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improper beacon events in matrix-js-sdk can result in availability issues - CVE-2022-39236
- Cross-site Scripting in Prism - CVE-2022-23647
- Strapi mishandles hidden attributes within admin API responses - CVE-2022-31367
- ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution - CVE-2022-25907
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023