Executive brief
realms-shim is a JavaScript library that implements a spec-compliant sandbox (isolated execution environment) for untrusted code. A prototype pollution vulnerability allows attackers to modify the inheritance chain of JavaScript objects, breaking out of the sandbox and gaining arbitrary code execution within the application process.
Technical details
The vulnerability is a prototype pollution attack (CWE-1321) affecting all versions of realms-shim up to and including 1.2.2. By polluting the prototype chain, an attacker can escape the intended sandbox isolation, leading to arbitrary code execution. The vulnerability is network-reachable and requires no authentication or user interaction—any code execution within the compromised realm can trigger the exploit. A patch is available; users should upgrade to a version beyond 1.2.2.
Affected products
- Agoric realms-shim all versions up to and including 1.2.2
Timeline
- 2022-01-10: disclosed: NVD published
- 2022-01-12: advisory: GHSA advisory published