| Package | Affected versions | Patched versions |
|---|---|---|
| directus | < 10.6.0 | 10.6.0 |
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox running code in the main nodejs context.
Patched in v10.6.0 by replacing vm2 with isolated-vm
None
https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free