Threats tagged 'ghsa-pq68-rvw4-xp4r'

vm2 NodeVM versions before 3.12.1 have a sandbox escape vulnerability due to an incomplete denylist of dangerous built-in modules. The denylist omits 'child_process', allowing sandboxed code configured with require:{builtin:['*']} or explicit 'child_process' allowance to execute arbitrary commands on the host system. This leads to full host remote code execution (RCE) from within the sandbox.