Vulnerability in pm2@5.3.0 Sandbox Escape
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 43.3k
- Forks
- 2.7k
- PR merge metrics
- No merged PRs in 30d
Description
What's going wrong?
- github caught a vulnerability in vm2 < 3.9.17 https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5
- This packaged is used by pm2@5.3.0 › pm2 > @pm2/agent > proxy-agent > pac-proxy-agent > pac-resolver > degenerator > vm2
How could we reproduce this issue?
Supporting information
Solution would be to update vm2 dependency to > 3.9.18. Fixed https://www.mend.io/vulnerability-database/CVE-2023-32314
$ pm2 report
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Trace the dependency chain from pm2 through @pm2/agent, proxy-agent, pac-proxy-agent, pac-resolver, and degenerator to vm2. Check the project’s dependency manifests and resolution, then confirm that vm2 is updated beyond 3.9.18 and the reported vulnerability is no longer present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100