AIKIDO-2026-10261

TL;DR

Affected versions of this package allow sandbox escape via WebAssembly.JSTag, where wasm exception handling can catch JavaScript exceptions and bypass transformer catch instrumentation that only wraps JS catch clauses. An attacker can craft a malicious wasm module that imports JSTag, triggers a host TypeError, captures the exception as an externref, and leverage the host error’s constructor chain to escape the sandbox. This enables unauthorized access to host objects and breaks isolation guarantees.