joyent/node — Issue #2486: vm module not suitable for sandboxing code
Author: wereHamster
Created: 2012-01-08 12:38:58+00:00
State: open

A new context (created by `vm.createContext`) exposes `process` in the global scope, which can be used to mess with the current process and other processes (`exit`, `kill`, `setuid` etc.)

Also, this text from the [documentation](http://nodejs.org/docs/latest/api/vm.html#vm.runInNewContext) is misleading:

[...] safely running untrusted code requires a separate process.

It is not possible to safely run untrusted code as long as a new context exposes `process`.

Would you kindly provide a way to create a truly sandboxed context?