GHSA-fwfx-rrv8-crpf: 
Rust vulnerability analysis and mitigation

The vulnerability (GHSA-fwfx-rrv8-crpf) affects the rustyscript package, discovered on July 18, 2024, and officially published to the GitHub Advisory Database on December 4, 2024. The issue exists in versions 0.4.0 through 0.6.0 of rustyscript, where the deno_core releases expose Deno.core.ops.op_panic to the JavaScript runtime in the base core (GitHub Advisory, RustSec Advisory).

The vulnerability stems from the exposure of the op_panic operation in the deno_core component. When called, this function triggers a manual panic in the thread containing the runtime. The issue has been classified as having Moderate severity, though no specific CVSS score has been assigned (GitHub Advisory).

This vulnerability can lead to denial-of-service conditions by allowing the forced panic of the runtime's containing thread (RustSec Advisory).

The vulnerability can be exploited by calling the exposed Deno.core.ops.op_panic function from within the JavaScript runtime, which directly triggers a panic in the containing thread (GitHub Issue).

The vulnerability has been patched in version 0.6.1 of rustyscript. The fix involves stubbing out the exposed operation with a code modification: Deno.core.ops.op_panic = (msg) => { throw new Error(msg) };. Users are advised to upgrade to version 0.6.1 or later to address this security issue (GitHub Issue, RustSec Advisory).