Περιγραφή
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, -__proto__-), Buffer.call.call({}.__lookupSetter__, Buffer, -__proto__-), and Node.js-s ERR_INVALID_ARG_TYPE Error, the host-s TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.
CVSS 10EPSS 0.619%Κίνδυνος 1.06
Προβολή πηγής- Δημοσίευση
- 2026-06-12 15:16:27
- Επηρεαζόμενες εκδόσεις
- <3.11.4
- Τύπος
- Βιβλιοθήκη
- Διάνυσμα
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H