vm2 critical vulnerability RCE the library will be discontinued (pm2@5.3.0)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 43.3k
- Forks
- 2.7k
- PR merge metrics
- No merged PRs in 30d
Description
Overview
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) such that handler sanitization can be bypassed, allowing attackers to escape the sandbox.
Introduced
pm2@5.3.0 › @pm2/agent@2.0.1 › proxy-agent@5.0.0 › pac-proxy-agent@5.0.0 › pac-resolver@5.0.1 › degenerator@3.0.4 › vm2@3.9.19
How to fix?
There is no fixed version for vm2.
Note:
According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.
References
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the dependency path through @pm2/agent, proxy-agent, pac-proxy-agent, pac-resolver, degenerator, and vm2, then read vm2 issue #533 and the Snyk advisory. The report states that vm2 has no fixed version, so completion requires an agreed way to remove or replace the vulnerable dependency and verify the resulting dependency tree.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100