Vulnerability: The deno_core exposes an op_panic in the base runtime which can force a panic in the runtime's containing thread

crates/js-sandbox/RUSTSEC-0000-0000.md

@@ -0,0 +1,22 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "js-sandbox"
+date = "2024-07-18"
+url = "https://github.com/Bromeon/js-sandbox/issues/31"
+categories = ["denial-of-service"]
+
+[versions]
+patched = []
+```
+
+# op_panic in the base runtime can force a panic in the runtime's containing thread
+
+Affected versions use deno_core releases that expose `Deno.core.ops.op_panic` to the JS runtime in the base core
+
+This function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing
+
+It can be fixed by stubbing out the exposed op:
+```javascript
+Deno.core.ops.op_panic = (msg) => { throw new Error(msg) };
+```

crates/rustyscript/RUSTSEC-0000-0000.md

@@ -0,0 +1,23 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "rustyscript"
+date = "2024-07-18"
+url = "https://github.com/rscarson/rustyscript/issues/174"
+categories = ["denial-of-service"]
+
+[versions]
+patched = [">= 0.6.1"]
+unaffected = ["<= 0.3.0"]
+```
+
+# op_panic in the base runtime can force a panic in the runtime's containing thread
+
+Affected versions use deno_core releases that expose `Deno.core.ops.op_panic` to the JS runtime in the base core
+
+This function when called triggers a manual panic in the thread containing the runtime.
+
+It can be fixed by stubbing out the exposed op:
+```javascript
+Deno.core.ops.op_panic = (msg) => { throw new Error(msg) };
+```