Skip to content

Conversation

@wonderofme
Copy link

Description

This Pull Request patches a Critical Remote Code Execution (RCE) vulnerability in the execution engine.

The Vulnerability:
The default configuration (UNSANDBOXED mode) previously used noOpCodeSandbox, which relies on the Function constructor. This allowed user-supplied code to access the host process process.env and execute arbitrary commands.

The Fix:
I have updated the loadCodeSandbox function to map UNSANDBOXED and SANDBOXED modes to loadV8IsolateSandbox. This ensures that even in default configurations, user code is executed within a secure V8 Isolate, preventing unauthorized access to the host server.

Type of Change

  • Security Patch
  • Bug fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant