CVE-2019-10761: Sandbox Bypass
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code running the script allowing it to spawn a childprocess and execute arbitrary code.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10761?
The severity of CVE-2019-10761 is categorized as high due to the potential for a denial of service through infinite recursion.
How do I fix CVE-2019-10761?
To fix CVE-2019-10761, upgrade the vm2 package to version 3.6.11 or later.
What versions are affected by CVE-2019-10761?
Versions of the vm2 package prior to 3.6.11 are affected by CVE-2019-10761.
What kind of vulnerability is CVE-2019-10761?
CVE-2019-10761 is a denial of service vulnerability caused by infinite recursion leading to a RangeError exception.
Can CVE-2019-10761 be exploited remotely?
Yes, CVE-2019-10761 can be exploited remotely if a malicious user controls the input to the sandboxed context.