Improper access control in vm2 - #VU129584

Detailed vulnerability description

The vulnerability allows a remote attacker to escape the sandbox and modify host objects.

The vulnerability exists due to improper access control in the vm2 bridge when processing attacker-controlled JavaScript in a default VM or inherited NodeVM. A remote attacker can mutate shared host intrinsic prototypes to escape the sandbox and modify host objects.

The issue involves mutable proxies to host-realm intrinsic prototypes, including Object.prototype, Array.prototype, and Function.prototype.

Remediation

Sources

• https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq
• https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L665-L676