[HIGH] vm.runInContext() is not a security sandbox, extensions can escape

[NotKiwy]

sandbox.js:223-228 uses vm.runInContext() thinking it s a safe sandbox. it s not.
extension can break out through the prototype chain and get their hands on process or require

Node.js docs literally say: "The node:vm module is not a security mechanism. Do not use it to run untrusted code.» (click). It s designed for executing code in diff contexts, not for keeping melicious code contained

extension that wants to escape can do it trivially. the whole sandbox is just a false sense of security.

fix: replace with a real sandbox pls like isolated-vm or run extension in a separate process with restricted permission, don t rely on vm for anything security-sensitive