Name of the Vulnerable Software and Affected Versions @zhaoyao91/eval-in-vm (affected versions not specified)

Description The issue allows for Sandbox Escape, leading to Remote Code Execution. The package fails to restrict access to the main context through this.constructor.constructor. This may allow attackers to execute arbitrary code in the system. Evaluating the payload this.constructor.constructor('return process.env')() can print the contents of process.env.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.