GHSA-F8GF-W286-FMQ2 vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

Summary When allowAsync is set to false, vm2 is expected to reject attempts to run asynchronous code. Direct use of Promise.prototype.then is blocked, but Promise static methods still assimilate attacker-controlled thenables. Promise.resolvethenable, Promise.allthenable, Promise.racethenable,...

NPM: vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

NPM: vm2: allowAsync: false can be bypassed through Promise thenable assimilation in VM and NodeVM vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8gf-w286-fmq2. This link is maintained to preserve external references. Original Description vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While...