New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(URGENT) Caja breakout #20

Open

joepie91 opened this issue Apr 22, 2016 · 1 comment

joepie91 commented Apr 22, 2016

Two vulnerabilities have been found in Caja, and a patched version has been released.

In their words:

This is a complete breach of the Caja sandbox. All users should immediately upgrade to Caja v6008 or later.

Owner

theSmaw commented Apr 25, 2016 •

edited

Loading

Thanks for this.

I believe this falls out of the scope of the sanitizer contained within this module. We're only wrapping https://github.com/google/caja/blob/master/src/com/google/caja/plugin/html-sanitizer.js here, which hasn't been updated since Feb 2016.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment