Executive brief
vm2 is a popular Node.js library that provides a secure sandbox for executing untrusted JavaScript code. A critical sandbox bypass vulnerability allows attackers to escape the sandbox and execute arbitrary code on the host system running vm2, potentially compromising the entire application and server.
Technical details
vm2 contains a sandbox escape vulnerability (CWE-913: Improper Control of Dynamically-Managed Code Resources) in its core sandbox setup mechanism. The vulnerability allows an attacker to bypass sandboxing protections and execute remote code on the host running the vm2 process. The attack requires network access to the application using vm2, with no authentication or user interaction required. An attacker can exploit this to gain complete control over the host system. The vulnerability was patched in vm2 version 3.9.11; all prior versions are vulnerable.
Affected products
- vm2 before 3.9.11
Timeline
- 2022-08-30: disclosed
- 2022-09-28: advisory
- 2022-09-28: patched: Version 3.9.11