GHSA-6jg8-7333-554w

Sandbox Breakout in realms-shim

9.8 CriticalFix available

Versions of realms-shim prior to 1.2.0 are vulnerable to a Sandbox Breakout. Reflect.construct can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code.

Recommendation

Upgrade to version 1.2.0 or later.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

GitHub Advisories Score used9.8

Sandbox Breakout in realms-shim

Recommendation

Upgrade to version 1.2.0 or later.

Record: GHSA-6jg8-7333-554w
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV9.8

Sandbox Breakout in realms-shim

Recommendation

Upgrade to version 1.2.0 or later.

Record: GHSA-6jg8-7333-554w
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`realms-shim` npm	before 1.2.0	1.2.0
`ses` npm	before 0.6.3	0.6.3

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-6jg8-7333-554w is a critical vulnerability (CVSS 9.8) in realms-shim, published October 4, 2019. No source lists public exploit code. Fixed in realms-shim 1.2.0.

Recommendation

Attack profile

How easy it is to exploit

What an attacker can affect

What each source reports

Recommendation

Recommendation

Affected packages

History

In short

References