Executive brief
vm2 is a popular Node.js library that provides a sandboxed JavaScript execution environment to safely run untrusted code. A vulnerability in versions before 3.6.11 allows attackers to break out of the sandbox and execute arbitrary commands on the host system by triggering a stack overflow that leaks host references, potentially leading to full system compromise.
Technical details
The vulnerability is a sandbox escape (CWE-674: Uncontrolled Recursion) caused by improper handling of stack limit errors. An attacker can trigger infinite recursion to cause a RangeError exception that originates from the host context rather than the sandboxed context. When this uncontextified RangeError is returned to the sandbox, the attacker can access its constructor chain to gain a reference to the host's mainModule and execute arbitrary code via require("child_process"). This requires no authentication and is triggered by running untrusted code within the VM context. The vulnerability is fixed in vm2 version 3.6.11 and later.
Affected products
- vm2 vm2 before 3.6.11
Timeline
- 2019-04-07: disclosed
- 2022-07-13: patched: Version 3.6.11 released