Executive brief
vm2 is a popular library used to run untrusted code in a secure, isolated "sandbox" environment. A flaw was discovered where the sandbox fails to block certain internal Node.js networking components, even when an administrator has explicitly configured the sandbox to deny network access. An attacker running code within the sandbox could exploit this to bypass security restrictions, allowing them to scan internal networks, access private cloud metadata, or communicate with sensitive local services.
Technical details
A capability bypass exists in vm2's NodeVM component prior to version 3.11.4. When NodeVM is configured with a wildcard builtin allowlist and specific network module exclusions (e.g., ['*', '-http', '-net']), it fails to filter out internal underscored Node.js modules such as _http_client, _http_server, and _tls_wrap. These internal modules provide the same network primitives as their public counterparts. An attacker with the ability to execute code in the sandbox can require these underscored modules to perform outbound HTTP requests (SSRF) or open listening sockets, effectively bypassing the intended security boundary. The issue is fixed in version 3.11.4 by explicitly excluding all underscored builtins from wildcard expansion.
Affected products
- patriksimek vm2 <= 3.11.3
Timeline
- 2026-05-17: patched: Fix committed to repository
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD