Privilege Issues in jailed

Description

All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.1

References

• GHSA-77m7-9wvw-87fx
• snyk.io
• CVE-2022-23923
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper beacon events in matrix-js-sdk can result in availability issues - CVE-2022-39236
• Cross-site Scripting in Prism - CVE-2022-23647
• Strapi mishandles hidden attributes within admin API responses - CVE-2022-31367
• ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution - CVE-2022-25907

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

jailed