GHSA-6pw2-5hjv-9pf7

Sandbox bypass in vm2

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23555

Packages

Ecosystem	Package	Affected	Fixed in
npm	vm2	< 3.9.6	3.9.6

Details

As written in the advisory (Markdown source, shown as plain text).

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23555 advisory
https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d web
https://github.com/patriksimek/vm2 package
https://snyk.io/vuln/SNYK-JS-VM2-2309905 web