Privilege Issues in jailed

Description

All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.1

References

• GHSA-77m7-9wvw-87fx
• snyk.io
• CVE-2022-23923
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype pollution in 101 - CVE-2021-25943
• Use-After-Free in puppeteer - CVE-2019-5786
• Open Redirect in node-forge - CVE-2022-0122
• Denial of service in three - CVE-2020-28496

Tags:

npm

jailed