GHSA-g6w6-h933-4rc5
Soketi was exposed to Sandbox Escape vulnerability via vm2
Quick fix
GHSA-g6w6-h933-4rc5 — @soketi/soketi: upgrade to the fixed version with the command below.
npm install @soketi/soketi@1.6.0Details
### Impact _What kind of vulnerability is it? Who is impacted?_ Anyone who might have used Soketi with the `cluster` driver (or through PM2).
### Patches _Has the problem been patched? What versions should users upgrade to?_ Get the latest version of Soketi.
### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ None. It's advised to upgrade to the latest version.
### References _Are there any links users can visit to find out more?_ - https://github.com/advisories/GHSA-cchq-frgv-rjh5 - https://github.com/patriksimek/vm2/issues/533 - https://github.com/Unitech/pm2/issues/5643
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/soketi/soketi/security/advisories/GHSA-g6w6-h933-4rc5[WEB]
- https://github.com/Unitech/pm2/issues/5643[WEB]
- https://github.com/patriksimek/vm2/issues/533[WEB]
- https://github.com/soketi/soketi/pull/927[WEB]
- https://github.com/soketi/soketi/commit/de12bff706c0d62e6a57dc1c7be3c4f014d0093a[WEB]
- https://github.com/advisories/GHSA-cchq-frgv-rjh5[ADVISORY]
- https://github.com/soketi/soketi[PACKAGE]
- https://github.com/soketi/soketi/releases/tag/1.6.0[WEB]