Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vm2 | npm | <= 3.11.5 | 3.11.6 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-m283-3h24-438v, is a sandbox escape in vm2 caused by improper sanitization of error objects. The root cause is the handleException function in lib/setup-sandbox.js. This function was designed to sanitize exceptions passed from the host to the sandboxed environment but failed to account for the Error.cause property, a standard feature introduced in ES2022. An attacker could exploit this by having an embedder-exposed host function throw an error where the .cause property references a powerful host object like process. The handleException function would process this error but leave the .cause property untouched, effectively leaking a handle to the host object into the sandbox. This allows the sandboxed code to achieve Remote Code Execution (RCE) on the host machine. The fixing commit, 7e3faaf550f4ab975bf4cdde183fcec49b056d8e, addresses this by significantly modifying handleException to rebuild error objects from scratch, ensuring that properties like .cause and any inherited properties from the prototype chain are properly sanitized or stripped, thus closing the vulnerability.
handleExceptionlib/setup-sandbox.js