Executive brief
@zhaoyao91/eval-in-vm is a Node.js library for executing JavaScript code in a sandboxed environment. The package fails to properly isolate execution context, allowing attackers to break out of the sandbox and execute arbitrary code on the host system with full access to environment variables, system resources, and process capabilities.
Technical details
The vulnerability is a sandbox escape caused by improper isolation of the JavaScript execution context. The package fails to restrict access to the main context through the `this.constructor.constructor` property chain, which can be exploited to access the Function constructor and execute arbitrary code. An attacker can evaluate a payload such as `this.constructor.constructor('return process.env')()` to break out of the sandbox and read sensitive environment variables or execute system commands. All versions of @zhaoyao91/eval-in-vm are affected, and no patch was available as of the advisory publication date. The attack requires only the ability to provide code to the eval function, with no additional authentication or user interaction required.
Affected products
- zhaoyao91 eval-in-vm all versions
Timeline
- 2020-09-04: disclosed