NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...

Exposure of Resource to Wrong Sphere

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the globalAgent process. An attacker can access sensitive HTTPS credentials and intercept or...

GHSA-5843-9MH5-HHGW Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h85j-hv3c-qfgq. This link is maintained to preserve external references. Original Description vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM i...