vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.
Weakness
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Developer Hub 1.10 | RedHat | rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend:1791242697 | * |
| Red Hat Developer Hub 1.10 | RedHat | rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend:1791251282 | * |