Executive brief
vm2 is a sandbox for running untrusted Node.js code. When configured with nesting enabled and an array-shaped require option, an attacker can bypass security controls to load the host vm2 module, create a malicious inner sandbox with unrestricted access to system modules like child_process, and execute arbitrary commands on the host system. This completely defeats the sandbox's isolation and allows an attacker to compromise the entire Node.js process and underlying system.
Technical details
The vulnerability is a logic error in the nesting guard that checks `hasRealRequireConfig`. The guard uses `typeof requireOpts === 'object' && requireOpts !== null` to validate that a require configuration is present, but arrays satisfy this condition even though they are not valid VMRequire configuration objects. When an array is passed as the require option, `makeResolverFromLegacyOptions()` destructures it, leaving builtin and external options undefined, which then merges with NESTING_OVERRIDE and returns a resolver containing only vm2's internal nesting loader. An attacker executing JavaScript in a NodeVM with `{nesting: true, require: []}` can require the host vm2 module, instantiate a new NodeVM with an attacker-controlled builtin allowlist (e.g., child_process), and execute arbitrary shell commands. The outer NodeVM's builtin restrictions do not constrain the inner NodeVM. The vulnerability requires nesting to be explicitly enabled and the require option to be set to an array; it is fixed in version 3.11.7.
Affected products
- vm2 vm2 >=3.11.4, <=3.11.6
Timeline
- 2026-08-24: disclosed
- 2026-08-14: patched: Fix committed; 3.11.7 released