GitHub Advisoryadvisory · npm

GHSA-wf5x-cr3r-xr77 vm2 before 3.6.11 vulnerable to sandbox escape

HIGH Published 2022-07-14 Modified 2022-07-22 Official page ↗
Aliases
CVE-2019-10761
Ecosystem
npm
Packages
vm2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-674
Reviewed
2022-07-15

Affected packages

• npm vm2: < 3.6.11 → fixed in 3.6.11

Description

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code running the script allowing it to spawn a child_process and execute arbitrary code.

Related

Alias · CVE (1)

  • CVE-2019-10761 This affects the package vm2 before 3.6.11. vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References