GHSA-7cg8-pq9v-x98q Sandbox Breakout in realms-shim
Attackers can break out of the realms-shim sandbox by providing a malicious rewriter function, leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7cg8-pq9v-x98q?
GHSA-7cg8-pq9v-x98q is a code injection vulnerability in realms-shim, published on 21 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting function. Confined code which used the evaluator itself could provide a malicious rewriter function that captured this object, and use it to breach the sandbox.
Recommendation
Upgrade to version 1.2.1 or later.
Which versions are affected by GHSA-7cg8-pq9v-x98q?
2 open source packages ship an affected version, including realms-shim.
| Package | Affected | Fixed in |
|---|---|---|
realms-shim npm | All versions | 1.2.1 |
realms-shim npm | All versions | 1.2.1 |
How do I fix GHSA-7cg8-pq9v-x98q?
Upgrade realms-shim to 1.2.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-7cg8-pq9v-x98q being exploited?
There is no known exploitation of GHSA-7cg8-pq9v-x98q in the wild and no public exploit code.