Original Post: The indomitable maintainer spirit versus the indifferent cruelty of JavaScript
On July 12, GitHub issued a security advisory for the JavaScript sandbox vm2, revealing two sandbox escape vulnerabilities that could lead to remote code execution. Despite these vulnerabilities, no fix is planned, and the vm2 project is being discontinued due to unresolvable issues. This has significant implications, as vm2 was the most popular open-source solution for sandboxing unsafe JavaScript code, especially on GitHub. The discontinuation shocked many in the application security community, highlighting a broader issue with how tech companies depend on under-resourced open-source projects. The advisory reveals that vm2 had eight security advisories within four months in the past year, indicating unsustainable stress on the maintainers.
Senior members in the field saw this coming due to the widespread reliance on open-source software without considering the maintainers’ capabilities or project health. The failure of vm2 underscores the need for better project management or choosing better-maintained alternatives from the start. Simek, vm2’s owner, recommended transitioning to an alternative called isolated-vm. Unlike vm2, isolated-vm uses v8’s Isolate interface, offering a potentially more secure long-term solution for sandboxing JavaScript. However, it also needs proper community support and contributions to succeed.
The discontinuation of vm2 acts as a crucial lesson for open-source software users and contributors, emphasizing the importance of supporting vital projects like isolated-vm to ensure sustainable and secure development practices.
Go here to read the Original Post