Evidence · DiggingBeagle record
GitHub Advisory GHSA-3g72-rrqc-f76c, Prefab UI Pyodide sandbox
The advisory states that Prefab UI 0.14.0 through 0.20.2 exposed Deno APIs to guest code through the Pyodide js bridge while the host process ran with filesystem and network permissions.
- Source role
- primary disclosure
Evidence record
The advisory states that Prefab UI 0.14.0 through 0.20.2 exposed Deno APIs to guest code through the Pyodide js bridge while the host process ran with filesystem and network permissions.
Claim-level citations (2)
- supportsPrefab UI generative sandbox exposed host Deno APIs to supplied Python code: The advisory states that Prefab UI 0.14.0 through 0.20.2 exposed Deno APIs to guest code through the Pyodide js bridge while the host process ran with filesystem and network permissions.
Advisory, affected versions and Pyodide js-to-Deno host access
- supportsPrefab UI generative sandbox exposed host Deno APIs to supplied Python code: The unreviewed Prefab advisory reports that generated Python could reach host Deno file APIs in versions 0.14.0 through 0.20.2 and identifies 0.21.0 as the fixed release.
GHSA-3g72-rrqc-f76c, Description, affected versions, and reported fix