Executive brief
lighter-vm is a JavaScript sandbox utility used to safely evaluate untrusted code. The vulnerability allows attackers to break out of the sandbox and execute arbitrary code on the host system by accessing the main JavaScript context through constructor chains. This completely defeats the sandbox protection, enabling full system compromise.
Technical details
lighter-vm fails to properly restrict access to the main JavaScript context, allowing attackers to bypass sandbox restrictions via prototype chain pollution and constructor property access. An attacker can craft a payload such as `this.constructor.constructor('return process.env')()` to access sensitive runtime objects like the Node.js `process` object and execute arbitrary code. The vulnerability affects all versions of the package from 0.0.0 onwards and requires no authentication or special preconditions—any code evaluated within the sandbox can exploit it. No patch has been released; users are advised to switch to alternative packages.
Affected products
- npm lighter-vm 0.0.0 and later (all versions)
Timeline
- 2020-09-04: disclosed