Executive brief
vm2 is a popular library used to run untrusted JavaScript code in a secure, isolated 'sandbox' environment. A flaw in its security filters allows an attacker to bypass these restrictions by using specific internal Node.js components that were not properly blocked. If exploited, an attacker can break out of the sandbox to execute arbitrary commands on the host server, potentially leading to full system compromise and data theft.
Technical details
A sandbox escape vulnerability exists in vm2's NodeVM due to an incomplete denylist of dangerous Node.js built-in modules. While the library attempts to block modules like 'child_process' and 'inspector', it fails to block 'process' and 'inspector/promises'. An attacker can use 'require(\'process\').getBuiltinModule(\'child_process\')' to reload restricted modules or use the inspector's 'Runtime.evaluate' to execute code in the host realm. This bypass is possible when the sandbox is configured to allow these specific modules or uses the '*' wildcard in the 'require.builtin' configuration. The issue is addressed in version 3.11.4 by implementing prefix-based matching for dangerous built-in families.
Affected products
- patriksimek vm2 <= 3.11.3
Timeline
- 2026-05-17: patched: Fix committed to repository
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD