Privilege Issues in jailed

Description

All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.1

References

• GHSA-77m7-9wvw-87fx
• snyk.io
• CVE-2022-23923
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper beacon events in matrix-js-sdk can result in availability issues - CVE-2022-39236
• Improper Privilege Management in shelljs - CVE-2022-0144
• Authorization bypass in url-parse - CVE-2022-0512
• url-parse Incorrectly parses URLs that include an '@ - CVE-2022-0639

Tags:

npm

jailed