CVE-2021-21413

isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to...

@ajay-testing/cli (>=0.6.0 <=0.12.0), @ajay-testing/forge-cli (=0.5.0) +32 more potentially affected by CVE-2021-21413 via isolated-vm (>=0.1.6 <=3.3.7)

isolated-vm NPM version =0.1.6, =0.6.0, =1.0.2, =0.0.1, =0.3.2, =0.48.0, =0.55.0, =0.42.0, =0.4.1, =0.0.27, =0.0.0-experimental-4dc04e6, =1.0.2-next.4 and more Source cves: CVE-2021-21413 Source advisory: OSV:GHSA-MMHJ-4W6J-76H7...

CVE-2021-21413

isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to...

CVE-2021-21413 Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate

isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to...

CVE-2021-21413

CVE-2021-21413 affects the isolated-vm library for Node.js prior to v4.0.0. The issue arises from API pitfalls where exposed Reference objects can reveal a reference to the nodejs context’s Function object and potentially the prototype chain, enabling attacks that could modify API objects or acce...