NPM: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

NPM: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback Unbounded Host Event-Loop Block vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

GHSA-R4FX-V8HH-22MV vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

Vulnerability Summary vm2's VM timeout option is documented and relied upon as the mechanism that bounds how long sandboxed code may execute. In the current implementation, the timeout only wraps the single synchronous call to VMrun via doWithTimeout → this.runScriptscript in lib/vm.js. It does...

vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

Vulnerability Summary vm2's VM timeout option is documented and relied upon as the mechanism that bounds how long sandboxed code may execute. In the current implementation, the timeout only wraps the single synchronous call to VMrun via doWithTimeout → this.runScriptscript in lib/vm.js. It does...