47 matches found
WS-2019-0315
In 'realms-shim', versions prior to v1.2.1 are vulnerable to sandbox breach. This can lead to a full compromise of the application...
WS-2019-0285
Ses before 0.6.3 contain an Outdated Static Dependency. The package relies on realms-shim and has it loaded statically instead of as a dependency that can be updated. The version of realms-shim it has contains multiple critical Sandbox Breakout vulnerabilities...
WS-2019-0284
Realms-shim before 1.2.0 is vulnerable to a Sandbox Breakout. The package's core evaluator, which must switch between "unsafe mode" and "safe mode" for each call, could be left in "unsafe mode" if an attacker is able to force a RangeError in a specific timeframe. This would allow the attacker to...
EUVD-2022-0668
Malicious code in bioql PyPI...
EUVD-2022-0670
Malicious code in bioql PyPI...
GHSA-Q4J7-V27R-FGCX Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
@agoric/cosmic-swingset (>=0.10.8-dev.0, <=0.18.0), @agoric/ertp (>=0.1.4, <=0.4.1) +18 more potentially affected by CVE-2021-23543 via realms-shim (1.2.2)
realms-shim NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on realms-shim and may be impacted: - @agoric/cosmic-swingset =0.10.8-dev.0, =0.1.4, =0.0.1, =0.1.1, =0.0.1, =0.0.20, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.4.1, =0.0.6,...
Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
GHSA-PWM7-QR6J-3VJG Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
@agoric/cosmic-swingset (>=0.10.8-dev.0, <=0.18.0), @agoric/ertp (>=0.1.4, <=0.4.1) +18 more potentially affected by CVE-2021-23594 via realms-shim (1.2.2)
realms-shim NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on realms-shim and may be impacted: - @agoric/cosmic-swingset =0.10.8-dev.0, =0.1.4, =0.0.1, =0.1.1, =0.0.1, =0.0.20, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.4.1, =0.0.6,...
Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
Prototype Pollution
realms-shim is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor, and prototype. and bypass the sandbox...
Sandbox Bypass
realms-shim is vulnerable to sandbox bypass. The vulnerability exists through the 'realmEvaluate' function in 'realm.js' as its does not properly validate the input, allowing an attacker bypass the sandbox by inject properties into existing construct prototypes...
CVE-2021-23594
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
CVE-2021-23594
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
CVE-2021-23594
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
CVE-2021-23543
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
CVE-2021-23543
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
