EUVD-2022-0670

Malicious code in bioql PyPI...

Sandbox Breakout

realms-shim is vulnerable to sandbox breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. An attacker is able to provide a malicious rewriter function that uses the confined code used within the evaluator...