CRITICAL SECURITY ISSUE: vm2 should bee replaced by isolated-vm

[vl4py]

Description

vm2 is sensible to sandbox escape attack. Since 3.9.19 the project is now discontinued. The main contributor recommand to migrate to isolated-vm.

[BenBirt]

Thanks. We are aware of the issue.

Currently we do not use vm2 to implement any sandbox/secure computation features. It's now just used as a way to easily execute JavaScript in the way that we need to do implement compilation.

We will replace it at some point.

[vl4py]

Thank you for the quick reply

[oikarinen]

@BenBirt any update on this?

[BenBirt]

No - as above, we do not use vm2 to implement any security boundary. We'll replace it, but that's at low priority.