Description
Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting function.
Recommendation
Update the realms-shim package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.2.1
- Patched version(s): 1.2.1
References
Could your website be exposed too?
SmartScanner can check your website for Sandbox Breakout in realms-shim and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Sandbox Breakout in realms-shim - realms-shim - Vulnerability
- Prototype Pollution in realms-shim - realms-shim - CVE-2021-23543
- Prototype Pollution in realms-shim - CVE-2021-23594
- Sandbox Breakout / Arbitrary Code Execution in localeval - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023