Executive brief
vm2 is a JavaScript sandbox library used to safely execute untrusted code in Node.js applications. A vulnerability in versions before 3.9.6 allows attackers to escape the sandbox and execute arbitrary code on the host system by manipulating error objects generated during stack trace creation. This bypasses the entire security boundary that vm2 is designed to provide.
Technical details
vm2 before version 3.9.6 is vulnerable to sandbox bypass (CWE-1321) through direct access to host error objects created by Node.js internals during stack trace generation. The vulnerability allows an attacker to break out of the sandbox environment and gain code execution on the host machine. The attack vector is network/local depending on how vm2 is exposed, requires no authentication or user interaction, and affects all previous versions. The issue was fixed in version 3.9.6 via internal restructuring and security improvements as documented in commit 532120d.
Affected products
- vm2 vm2 before 3.9.6
Timeline
- 2022-02-11: disclosed: Published on NVD
- 2022-02-14: patched: Fixed in version 3.9.6