Closed
Description
- Version: 6.5.0
- Platform:
- Subsystem: vm
vm.runInContext is memory unsafe and can be used to dump core.
This doesn't seem like a serious security vulnerability (hence my reporting here), but can certainly be used to cause DOS and it might be nice to have a stdlib that is memory safe.
const vm = require('vm');
const target = {a : 1337};
const handler = {
getOwnPropertyDescriptor: (target, prop) => {
throw 'w00t';
// causes FromJust on line 128 of src/node_contextify.cc to dump core
},
};
const sandbox = new Proxy(target, handler);
const context = new vm.createContext(sandbox);
const script = new vm.Script('');
script.runInContext(context);