GHSA-xj72-wvfv-8985 vm2 Sandbox Escape vulnerability

• npm vm2: < 3.9.16 → fixed in 3.9.16

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. Patches This vulnerability was patched in the release of version `3.9.16` of `vm2`. Workarounds None. References Github Issue - https://github.com/patriksimek/vm2/issues/516 PoC - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c For more information If you have any questions or comments about this advisory: • Open an issue in VM2 Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.