- cvss
- 9.8
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code.
## Recommendation
Upgrade to version 1.2.0 or later.
Patch / fix
- npm realms-shim 1.2.0
- npm ses 0.6.3
Is GHSA-6jg8-7333-554w in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | realms-shim | <1.2.0 |
1.2.0 |
| npm | ses | <0.6.3 |
0.6.3 |
References
-
github.com
/Agoric/realms-shim/security/advisories/GHSA-6jg8-7333-554w
web
-
github.com
/Agoric/realms-shim
web
-
github.com
/advisories/GHSA-6jg8-7333-554w
advisory
-
snyk.io
/vuln/SNYK-JS-REALMSSHIM-471680
web
-
npmjs.com
/advisories/1180
web
-
npmjs.com
/advisories/1181
web
-
npmjs.com
/advisories/1182
web
-
npmjs.com
/advisories/1190
web
-
npmjs.com
/advisories/1191
web
Sources
- GitHub Advisory GHSA-6jg8-7333-554w
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.