GitHub Advisoryadvisory · npm

GHSA-22rr-f3p8-5gf8 Directus affected by VM2 sandbox escape vulnerability

HIGH Published 2023-09-15 Modified 2023-09-15 Official page ↗

Ecosystem: npm
Packages: directus
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Reviewed: 2023-09-15

Affected packages

• npm directus: < 10.6.0 → fixed in 10.6.0

Description

Impact In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox running code in the main nodejs context. Patches Patched in v10.6.0 by replacing `vm2` with `isolated-vm` Workarounds None References https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5

References

https://github.com/directus/directus/security/advisories/GHSA-22rr-f3p8-5gf8 web
https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 web
https://github.com/directus/directus/pull/19332 web
https://github.com/directus/directus/commit/284156426fa94f688e8d65a7a4f34f9e6705f058 web
https://github.com/directus/directus package