Critical severity - Remote Code Execution (RCE) vulnerability in vm2 (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: vm2
• Introduced through: [email protected], [email protected] and others

Detailed paths

• Introduced through: [email protected] › [email protected] › [email protected]

Overview

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient checks which allow an attacker to escape the sandbox.

Note:

According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.

Remediation

There is no fixed version for vm2.

References

• GitHub Issue
  
  SNYK-JS-VM2-5772823
  [email protected]