Critical severity - Remote Code Execution (RCE) vulnerability in vm2 (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: vm2
• Introduced through: juice-shop@12.3.0, juicy-chat-bot@0.6.6 and others

Detailed paths

• Introduced through: juice-shop@12.3.0 › juicy-chat-bot@0.6.6 › vm2@3.9.11

Overview

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) such that the Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox.

Note:

According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.

Remediation

There is no fixed version for vm2.

References

• GitHub Issue
  
  SNYK-JS-VM2-5772825
  (CVE-2023-37466) vm2@3.9.11