ghsa:GHSA-4XMW-HH9Q-4Q7C: vm2 <= 3.11.7

Affected technology

vm2 · <= 3.11.7
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox. Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.