Closed rafaeltc closed 1 year ago
We're keeping an eye on upstream for a fix for the moment.
In the meantime, here's some information about Honeycomb's use of vm2:
pac+http://www.example.com/proxy.pac
(according to our current understanding, confirmed upstream)
proxy-agent release 6.3.0 contains a fix in f1f3220d1.
superagent-proxy's dependency on proxy-agent is currently ^5.0.0
(>=5.0.0, < 6
). Awaiting an update to the version constraint there—maybe from this PR?—and a release.
Versions
Description
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. The vm2 project alerts to the existence of critical security issues and claims to have been discontinued, therefore recommending replacing vm2 with isolated-vm.