Node.js · Senior · Question 32 of 75

Why is `eval` (or `new Function`) on user input dangerous even in a 'sandbox' like `vm`?

✓Correct answer: It gives the input full code execution; the vm module is explicitly not a security boundary
2It's only slow, not dangerous
3vm blocks access to process, so it is safe

Explanation

Escapes from vm contexts are well known. Run untrusted code in a separate process or container with strict limits, or avoid running it at all.

Further reading

Test yourself

Take the Node.js · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.