-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how Proxy handler arguments were handled pre-patch. The PoC demonstrates that when a Proxy's apply trap is invoked, V8 passes arguments as a host-created array (argArray). In vulnerable versions, vm2 failed to properly wrap these host-originating arguments arrays, allowing access to the host's Function constructor through arguments.constructor.constructor. The commit adds wrapping logic (wrapProxyHandler, makeSafeHandlerArgs) to sanitize handler arguments, confirming the vulnerability existed in the original Proxy handling implementation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vm2 | npm | < 3.9.18 | 3.9.18 |