CVE-2021-23543

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23543

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

Code injection

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23543

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23543 Sandbox Bypass

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23543

CVE-2021-23543 affects the npm package realms-shim. The vulnerability is a Sandbox Bypass via Prototype Pollution in realms-shim, with root causes involving unsafe recursive merges and prototype/ 'proto ' manipulation in object merges or path definitions (as described in the Snyk/NVD entries and ...

CVE-2021-23594

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23594

The CVE concerns realms-shim, a shim for the Realm API, vulnerable to Sandbox Bypass via Prototype Pollution. The root cause is unsafe prototype/recursive merge behavior that can pollute Object.prototype (and related constructs), enabling manipulation of prototypes and potentially remote code exe...

CVE-2021-23594 Sandbox Bypass

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

PT-2022-9409

Name of the Vulnerable Software and Affected Versions realms-shim versions affected versions not specified Description The issue is related to a Sandbox Bypass via a Prototype Pollution attack vector. Recommendations At the moment, there is no information about a newer version that contains a fix...

PT-2022-9417

Name of the Vulnerable Software and Affected Versions realms-shim affected versions not specified Description The issue is related to a Sandbox Bypass via a Prototype Pollution attack vector. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2021-23594: Improperly Controlled Modification of Object Prototype Attributes

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

CVE-2021-23543: Improperly Controlled Modification of Object Prototype Attributes

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...

Sandbox Bypass

Overview realms-shim is a shim implementation of the Realm API Proposal. Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. PoC javascript import Realm from 'realms-shim' let realm = Realm.makeRootRealm; realm.evaluate function test try tes...

@agoric/cosmic-swingset (>=0.10.8-dev.0, <=0.18.0), @agoric/ertp (>=0.1.4, <=0.4.1) +18 more potentially affected by CVE-2021-23543 via realms-shim (1.2.2)

realms-shim NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on realms-shim and may be impacted: - @agoric/cosmic-swingset =0.10.8-dev.0, =0.1.4, =0.0.1, =0.1.1, =0.0.1, =0.0.20, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.4.1, =0.0.6,...

Sandbox Bypass

Overview realms-shim is a shim implementation of the Realm API Proposal. Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. PoC javascript import Realm from 'realms-shim' let realm = Realm.makeRootRealm; try realm.evaluate...

@agoric/cosmic-swingset (>=0.10.8-dev.0, <=0.18.0), @agoric/ertp (>=0.1.4, <=0.4.1) +18 more potentially affected by CVE-2021-23594 via realms-shim (1.2.2)

realms-shim NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on realms-shim and may be impacted: - @agoric/cosmic-swingset =0.10.8-dev.0, =0.1.4, =0.0.1, =0.1.1, =0.0.1, =0.0.20, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.4.1, =0.0.6,...

GHSA-8VF3-4W62-M3PQ XSS in Keycloak

It was found in all keycloak versions before 9.0.0 that links to external applications Application Links in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further...

GHSA-7CG8-PQ9V-X98Q Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting...

Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting...