Mausamrijall

**Name of the Vulnerable Software and Affected Versions** vm2 versions prior to 3.11.7 **Description** The software fails to enforce the `timeout` option for code executed outside the synchronous `run()` function. This occurs because the timeout only wraps the ` runScript()` call via `doWithTimeout()` in the `lib/vm.js` file. Additionally, `FinalizationRegistry` and `WeakRef` are exposed to sandboxed code without modifications. An attacker can register a `FinalizationRegistry` cleanup callback and remove all strong references to the object. While the `run()` function may return within the timeout, the V8 garbage collector later invokes the cleanup callback outside the timeout accounting. A busy loop within this callback can block the host event loop indefinitely, leading to a denial of service. The timing of this execution depends on the garbage collector's behavior, such as memory pressure or the use of the `--expose-gc` flag. **Recommendations** Update to version 3.11.7 or later.