Executive brief
vm2 is a JavaScript sandbox library that isolates untrusted code execution in a restricted environment. A vulnerability in vm2 allows attackers to bypass sandbox protections through improper Proxy object handling, enabling remote code execution on the host system running the sandbox. This could allow malicious scripts to escape isolation and compromise the entire system.
Technical details
vm2 is a JavaScript sandbox library designed to safely execute untrusted code in an isolated environment. The vulnerability exists in versions up to 3.9.17 and stems from improper handling of Proxy object specifications, which allows creation of unintended host objects that breach sandbox isolation. An attacker can craft malicious JavaScript code that exploits this Proxy mechanism to escape the sandbox without requiring authentication or user interaction. Successful exploitation grants the attacker remote code execution on the host system. The vulnerability was fixed in version 3.9.18. A proof-of-concept demonstrating the sandbox escape is publicly available.
Affected products
- <UNKNOWN> vm2 up to 3.9.17
Timeline
- 2023-05-15: disclosed
- 2023-05-15: patched: Version 3.9.18 released