Hoppscotch CLI: Fix for Sandbox Escape Vulnerability

CVE-2024-34347

What is CVE-2024-34347?

The @hoppscotch/cli has a significant vulnerability in its @hoppscotch/js-sandbox component, which is designed to execute Hoppscotch Test Scripts within Continuous Integration (CI) environments. Prior to version 0.8.0, this package utilized Node.js's vm module to create a sandbox for running untrusted JavaScript. However, due to the inherent limitations of the vm module, the sandbox implementation failed to securely isolate execution contexts. By passing multiple references to external objects into the vm, the pre-request scripts could potentially escape the sandbox environment, leading to unauthorized access or execution of sensitive operations within the CI pipeline. This issue has been addressed and resolved in version 0.8.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References