node-pty vs runAsNode CVE

[Trung Nguyen (trungutt)]

Hey there 👋

Does anyone run into the situation where we need to conform to security policy regarding "runAsNode" CVE?

If we follow the mitigation, which means disabling runAsNode fuse, but accepting this drawback:

Please note that if this fuse is disabled, then process.fork in the main process will not function as expected as it depends on this environment variable to function.

then node-pty won't work as expected in some cases, e.g calling .kill() on Windows. This has fork API call under the hood.

Does anyone have a clue on this? TIA