GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6rh5-qq4q-97xh. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard...