Sandbox Bypass Leading to Arbitrary Code Execution in constantinople

Description

Versions of constantinople prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.

Recommendation

Update the constantinople package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.1.1
• Patched version(s): 3.1.1

References

• GHSA-4vmm-mhcq-4x9j
• bugzilla.redhat.com
• www.npmjs.com
• snyk.io

Related Issues

• Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval - GHSA-876r-hj45-fw7g - Vulnerability
• Sandbox Breakout / Arbitrary Code Execution in localeval - Vulnerability
• Arbitrary Code Execution in handlebars - Vulnerability
• Vega vulnerable to arbitrary code execution when clicking href links - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

constantinople