{"id":"GHSA-4mw5-2636-4535","aliases":["RUSTSEC-2024-0403"],"url":"https://o3.security/vulnerability/GHSA-4mw5-2636-4535","summary":"op_panic in the base runtime can force a panic in the runtime's containing thread","details":"Affected versions use deno_core releases that expose `Deno.core.ops.op_panic` to the JS runtime in the base core\n\nThis function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing\n\nIt can be fixed by stubbing out the exposed op:\n```javascript\nDeno.core.ops.op_panic = (msg) => { throw new Error(msg) };\n```","published":"2024-12-04T18:36:38Z","modified":"2025-10-28T06:29:23.047131Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"js-sandbox","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/Bromeon/js-sandbox/issues/31"},{"type":"PACKAGE","url":"https://github.com/Bromeon/js-sandbox"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0403.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-10-28T06:29:23.047131Z"}}