Developers for years have been using vm2, an open-source Node.js library, to run untrusted JavaScript inside a secure and isolated sandbox environment. It uses Node.js’s built-in modules and JavaScript Proxies and lets developers whitelist particular built-in Node modules or limit what the script can access.During that time, vm2 has been the default for safely running … Continue reading Critical Flaw in isolated-vm Can Lead to Sandbox Escape, RCE Threat