CyberRota Analysis
AI-GeneratedThe vulnerability allows sandboxed code in vm2 versions prior to 3.11.6 to access sensitive host process information and manipulate DNS settings, potentially redirecting all DNS queries through an attacker-controlled resolver. This critical flaw poses a significant risk to applications relying on vm2 for sandboxing, as it can lead to unauthorized access and data exfiltration. Organizations using vm2 for security-sensitive operations should prioritize immediate updates to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.