Internet Bug Bounty: Dependency Policy Bypass via process.binding

Preface (for the Internet Bug Bounty) The entire vulnerability can be found in HackerOne @ Dependency Policy Bypass via process.binding. For the sake of convenience, I've pasted the entire report down below. Copied Vulnerability Summary: By taking advantage of process.binding('spawn_sync');, a malicious actor can run arbitrary code, outside of the limits defined in a policy.json file. Description: The experimental policy feature for NodeJS is used usually for security reasons, including validating integrity of source code and limiting module access to files. This vulnerability allows an actor to bypass the latter part of its security features, by loading in any module from an external Node.JS script. Since the required modules use internal bindings, by fetching these bindings themselves, it is possible to neglect the dependency policy altogether. This also exists within almost all process.binding modules with less or the same severity. Steps To Reproduce: Create policy.json: json { "onerror": "exit", "scopes": { "file:": { "integrity": true, "dependencies": {} } } } Create app.js: ```js const { spawn } = process.binding("spawn_sync"); function arbitraryExecute(input) { const result = spawn({ maxBuffer: 1048576, args: ["node", "-"], cwd: undefined, detached: false, file: "node", windowsHide: false, windowsVerbatimArguments: false, killSignal: undefined, stdio:...