Insufficient Isolation of System-Dependent Functions
CWE-1100
The product or code does not isolate system-dependent functionality into separate standalone modules.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
Latest Insufficient Isolation of System-Dependent Functions vulnerabilities
- 9.8 Critical severity
vm2: Exposure of Resource to Wrong Sphere
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox.
- 9.1 Critical severity
vm2: Improper Access Control
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the s
- 7.2 High severity
langgenius/dify: Insufficient Isolation of System-Dependent Functions
langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseIn