[GHSA-fm4j-4xhm-xpwx] Sandbox Breakout / Arbitrary Code Execution in sandbox #6760
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the security advisory GHSA-fm4j-4xhm-xpwx to reflect that the sandbox package vulnerability has been addressed in version 1.0.0 and later. The advisory documents a sandbox breakout/arbitrary code execution vulnerability that existed in earlier versions of the package before it changed ownership and became the Vercel Sandbox SDK.
Changes:
- Updated the
modifiedtimestamp to reflect the advisory revision - Added a
fixedversion range indicating the vulnerability is resolved in versions >= 1.0.0
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
github-actions
bot
changed the base branch from
main
to
robherley/advisory-improvement-6760
advisory-database
bot
merged commit da279f3
into
robherley/advisory-improvement-6760
|
Hi @robherley! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
The
sandboxpackage has changed owners and is now an SDK for Vercel Sandbox. The exploits are not relevant to the new package versions.