CVE-2021-23543

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23543 Sandbox Bypass

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23543

CVE-2021-23543 affects the npm package realms-shim. The vulnerability is a Sandbox Bypass via Prototype Pollution in realms-shim, with root causes involving unsafe recursive merges and prototype/ 'proto ' manipulation in object merges or path definitions (as described in the Snyk/NVD entries and ...

CVE-2021-23594

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23594

The CVE concerns realms-shim, a shim for the Realm API, vulnerable to Sandbox Bypass via Prototype Pollution. The root cause is unsafe prototype/recursive merge behavior that can pollute Object.prototype (and related constructs), enabling manipulation of prototypes and potentially remote code exe...

CVE-2021-23594 Sandbox Bypass

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

PT-2022-9409

Name of the Vulnerable Software and Affected Versions realms-shim versions affected versions not specified Description The issue is related to a Sandbox Bypass via a Prototype Pollution attack vector. Recommendations At the moment, there is no information about a newer version that contains a fix...

CVE-2021-23543: Improperly Controlled Modification of Object Prototype Attributes

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23594: Improperly Controlled Modification of Object Prototype Attributes

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

PT-2022-9417

Name of the Vulnerable Software and Affected Versions realms-shim affected versions not specified Description The issue is related to a Sandbox Bypass via a Prototype Pollution attack vector. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

@agoric/cosmic-swingset (>=0.10.8-dev.0, <=0.18.0), @agoric/ertp (>=0.1.4, <=0.4.1) +18 more potentially affected by CVE-2021-23543 via realms-shim (1.2.2)

realms-shim NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on realms-shim and may be impacted: - @agoric/cosmic-swingset =0.10.8-dev.0, =0.1.4, =0.0.1, =0.1.1, =0.0.1, =0.0.20, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.4.1, =0.0.6,...

Sandbox Bypass

Overview realms-shim is a shim implementation of the Realm API Proposal. Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. PoC javascript import Realm from 'realms-shim' let realm = Realm.makeRootRealm; realm.evaluate function test try tes...

@agoric/cosmic-swingset (>=0.10.8-dev.0, <=0.18.0), @agoric/ertp (>=0.1.4, <=0.4.1) +18 more potentially affected by CVE-2021-23594 via realms-shim (1.2.2)

realms-shim NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on realms-shim and may be impacted: - @agoric/cosmic-swingset =0.10.8-dev.0, =0.1.4, =0.0.1, =0.1.1, =0.0.1, =0.0.20, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.4.1, =0.0.6,...

Sandbox Bypass

Overview realms-shim is a shim implementation of the Realm API Proposal. Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. PoC javascript import Realm from 'realms-shim' let realm = Realm.makeRootRealm; try realm.evaluate...

GHSA-7CG8-PQ9V-X98Q Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting...

Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting...

PT-2019-20020

Name of the Vulnerable Software and Affected Versions realms-shim versions prior to 1.2.1 Description The issue concerns a Sandbox Breakout in the Realms evaluation function, which has an option to apply transformations to the source code before evaluation. A part of this transformation pipeline...

Sandbox Breakout

realms-shim is vulnerable to sandbox breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. An attacker is able to provide a malicious rewriter function that uses the confined code used within the evaluator...

Sandbox Breakout

Overview Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the...

Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.0 are vulnerable to a Sandbox Breakout. Reflect.construct can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code. Recommendation Upgrade to...