Thank you, ProPublica! Remember the names of these murderers. They ought to be brought to justice once the administration changes. They belong in prison for the rest of their natural lives.
#murderers #execution #CBP #ICE #Minneapolis #justice #Pretti #Good #ProPublica #immigration #USPolitics #USPol #government #criminal #TraitorGOP #TraitorMAGA


![⁉️"In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed," vm2 maintainer Patrik Simek said. "This allows attackers to escape the sandbox and run arbitrary code."⁉️
<https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8>
vm2 is a Node.js library used to run untrusted code within a secure sandboxed environment by intercepting and proxying JavaScript objects to prevent sandboxed code from accessing the host environment.
<https://github.com/patriksimek/vm2>
<https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy>
The newly discovered flaw stems from the library's improper sanitization of Promise handlers, which creates an escape vector that results in the execution of arbitrary code outside the sandbox boundaries.
<https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise>
"The critical insight is that async functions in JavaScript return `globalPromise` objects, not `localPromise` objects. Since `globalPromise.prototype.then` and `globalPromise.prototype.catch` are not properly sanitized [unlike `localPromise`]," Endor Labs researchers Peyton Kennedy and Cris Staicu said.
👾In light of the criticality of the flaw, users are recommended to update to the most recent version [3.10.3], which comes with fixes for additional sandbox escapes.👾
<https://github.com/patriksimek/vm2/releases/tag/v3.10.3>](https://files.mastodon.social/cache/media_attachments/files/116/001/368/055/155/609/small/510dc1dbf0a3bcc0.jpeg)
