build2 publishers
A double-read in isolated-vm turns customer JavaScript into host code execution
GHSA-864f-rcv7-6rh4 lets guest code hand the C++ bindings one type on the first read and a different one on the second. Fixes are in 7.0.1 and 6.2.0.
Reality
- Evidence60
- Adoption50
- Hype gap+20
- Incentives60
- Confidence58