NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...