| Package | Affected versions | Patched versions |
|---|---|---|
| vm2 | < 3.9.11 | 3.9.11 |
| vm2 | < 3.9.11 | 3.9.11 |
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.
This vulnerability was patched in the release of version 3.9.11 of vm2
None.
Github Issue - https://github.com/patriksimek/vm2/issues/467 The file that was patched - https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71 The commit with the patch - https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free