Homepage

@nyariv/sandboxjs@0.8.32

Javascript sandboxing library.

  • latest version

    0.9.5

  • latest non vulnerable version

    0.9.5

  • first published

    6 years ago

  • latest version published

    6 hours ago

  • licenses detected

  • View sandboxjs package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @nyariv/sandboxjs package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Exposure of Resource to Wrong Sphere

    @nyariv/sandboxjs is a Javascript sandboxing library.

    Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the New handler due to missing sanitization of both constructor arguments and return values. An attacker can access and modify internal interpreter objects, including scope variables outside the intended sandbox, by passing specially crafted arguments that leak references to protected objects. This is only exploitable if the host application reads the return value from the sandbox execution, which is the standard and documented usage pattern.

    How to fix Exposure of Resource to Wrong Sphere?

    Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.

    <0.8.36
    • C
    Improperly Controlled Modification of Dynamically-Determined Object Attributes

    @nyariv/sandboxjs is a Javascript sandboxing library.

    Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the constructor process. An attacker can modify host global objects and persist these changes across sandbox instances by invoking the exposed constructor with attacker-controlled payloads. This allows the attacker to inject arbitrary properties into shared global objects, potentially leading to the execution of malicious code or alteration of application logic when these mutated properties are later used by the host application.

    How to fix Improperly Controlled Modification of Dynamically-Determined Object Attributes?

    Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.

    <0.8.36
    • M
    Uncontrolled Recursion

    @nyariv/sandboxjs is a Javascript sandboxing library.

    Affected versions of this package are vulnerable to Uncontrolled Recursion via the restOfExp function and the recursive call chain involving lispify and lispifyExpr. An attacker can cause the process to crash by supplying deeply nested expressions that trigger unbounded recursion.

    How to fix Uncontrolled Recursion?

    Upgrade @nyariv/sandboxjs to version 0.8.36 or higher.

    <0.8.36
    • L
    Race Condition

    @nyariv/sandboxjs is a Javascript sandboxing library.

    Affected versions of this package are vulnerable to Race Condition through the global currentTicks.current state shared between concurrent sandboxes. An attacker can consume excessive CPU resources and bypass execution quotas by manipulating the global tick state during timer handler execution in a multi-tenant environment.

    How to fix Race Condition?

    Upgrade @nyariv/sandboxjs to version 0.8.35 or higher.

    <0.8.35
    • H
    Arbitrary Code Injection

    @nyariv/sandboxjs is a Javascript sandboxing library.

    Affected versions of this package are vulnerable to Arbitrary Code Injection via the executor module. An attacker can execute arbitrary code by crafting input that allows them get to arrays containing Function() and escape the intended sandbox restrictions by invoking system-level commands.

    How to fix Arbitrary Code Injection?

    Upgrade @nyariv/sandboxjs to version 0.8.34 or higher.

    <0.8.34
    Go back to all versions of this package