Privilege Issues in jailed

Description

All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.1

References

• GHSA-77m7-9wvw-87fx
• snyk.io
• CVE-2022-23923
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper beacon events in matrix-js-sdk can result in availability issues - CVE-2022-39236
• Improper Privilege Management in shelljs - CVE-2022-0144
• Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability (GHSA-m5vv-6r4h-3vj9) - CVE-2024-35255
• jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label - CVE-2022-31160

Tags:

npm

jailed