Threats tagged 'ghsa-8hg8-63c5-gwmx'

A vulnerability in the vm2 library's NodeVM with the option nesting: true allows sandboxed code to bypass require restrictions and load the vm2 module itself. This enables the creation of an inner NodeVM with unrestricted require capabilities, allowing execution of arbitrary OS commands on the host. The issue arises because nesting: true injects vm2 into the sandbox's builtins unconditionally, overriding require: false or any allowlist. This flaw affects all vm2 versions prior to 3.11.1.