pentester.land· Nov 15, 2022· by Gal Goldsthein (@G4lGo89), Yuval Ostrovsky (@yuvalo1212), Daniel Abeles (@Daniel_Abeles)

Remote Code Execution in Spotify’s Backstage via vm2 Sandbox Escape (CVSS Score of 9.8)

Target Program: Spotify

🎯 Vulnerability: Remote Code Execution (RCE)

💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.

#RCE#VM sandbox escape