Skip to content
OpenAdvisories

Package · npm

ses

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.7
    CVE-2025-32792

    ses's global contour bindings leak into Compartment lexical scope

    SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using `ses` and the Compartment API to evaluate third-party code in an…

    endojs endo ses npm
  • Critical 9.8
    CVE-2023-39532

    SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution

    SES is a JavaScript environment that allows safe execution of arbitrary programs in Compartments. In version 0.18.0 prior to 0.18.7, 0.17.0 prior to 0.17.1, 0.16.0 prior to 0.16.1, 0.15.0 prior to 0.15.24, 0.14.0 prior to 0.14.5, an 0.13.0 prior to 0.13.5, th…

    endojs endo ses npm
  • Low —
    GHSA-whpx-q3rq-w8jc

    Hardening of TypedArrays with non-canonical numeric property names in SES

    ### Impact _What kind of vulnerability is it? Who is impacted?_ In Hardened JavaScript, programs can `harden` objects to safely share objects with co-tenant programs without risk of these other programs tampering with their API surface. Hardening does not gua…

    ses npm
  • Critical 9.8
    GHSA-6jg8-7333-554w

    Sandbox Breakout in realms-shim

    Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arb…

    realms-shim ses npm