GHSA-fwfx-rrv8-crpf: 
Rust vulnerability analysis and mitigation

The vulnerability (GHSA-fwfx-rrv8-crpf) affects the rustyscript package, discovered on July 18, 2024, and officially published to the GitHub Advisory Database on December 4, 2024. The issue exists in versions 0.4.0 through 0.6.0 of rustyscript, where the denocore releases expose Deno.core.ops.oppanic to the JavaScript runtime in the base core (GitHub Advisory, RustSec Advisory).

The vulnerability stems from the exposure of the oppanic operation in the denocore component. When called, this function triggers a manual panic in the thread containing the runtime. The issue has been classified as having Moderate severity, though no specific CVSS score has been assigned (GitHub Advisory).

This vulnerability can lead to denial-of-service conditions by allowing the forced panic of the runtime's containing thread (RustSec Advisory).

The vulnerability has been patched in version 0.6.1 of rustyscript. The fix involves stubbing out the exposed operation with a code modification: Deno.core.ops.op_panic = (msg) => { throw new Error(msg) };. Users are advised to upgrade to version 0.6.1 or later to address this security issue (GitHub Issue, RustSec Advisory).