Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yMnJyLWYzcDgtNWdmOM4AA15b

Directus affected by VM2 sandbox escape vulnerability

Impact

In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox running code in the main nodejs context.

Patches

Patched in v10.6.0 by replacing vm2 with isolated-vm

Workarounds

None

References

https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5

Permalink: https://github.com/advisories/GHSA-22rr-f3p8-5gf8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yMnJyLWYzcDgtNWdmOM4AA15b
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 8 months ago
Updated: 8 months ago

CVSS Score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Identifiers: GHSA-22rr-f3p8-5gf8
References:

• https://github.com/directus/directus/security/advisories/GHSA-22rr-f3p8-5gf8
• https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
• https://github.com/directus/directus/pull/19332
• https://github.com/directus/directus/commit/284156426fa94f688e8d65a7a4f34f9e6705f058
• https://github.com/advisories/GHSA-22rr-f3p8-5gf8

Repository: https://github.com/directus/directus
Blast Radius: 15.9

Affected Packages