bromeon/js-sandbox · Security

op_panic in the base runtime can force a panic in the runtime's containing thread

GHSA ID
GHSA-4mw5-2636-4535
Severity
medium
Published
Updated

Description

Affected versions use deno_core releases that expose Deno.core.ops.op_panic to the JS runtime in the base core

This function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing

It can be fixed by stubbing out the exposed op:

Deno.core.ops.op_panic = (msg) => { throw new Error(msg) };

References