Executive brief
vm2 is a popular sandbox library used to safely execute untrusted JavaScript code in a Node.js environment while restricting access to system modules and external packages. The vulnerability allows attackers to bypass package restrictions by requesting a package name that contains an allowlisted substring (e.g., requesting "evil-left-pad" when only "left-pad" is allowed), leading to arbitrary code execution in the host context outside the sandbox.
Technical details
The vulnerability is an authorization bypass in NodeVM's external package allowlist mechanism. vm2 generates a regular expression from the allowlist but fails to anchor it to package-name boundaries, performing a substring match instead of an exact match. An attacker can request a colliding package name containing an allowlisted substring; if that colliding package exists in a path resolvable by the custom resolver, vm2 will load and execute it in the host context (when context: 'host' is configured), bypassing sandbox restrictions. This requires the colliding package to already be present in a resolvable path or for the application's dependency workflow to place it there. Patched in version 3.11.7.
Affected products
- patriksimek vm2 before 3.11.7
Timeline
- 2026-08-24: disclosed
- 2026-09-17: advisory
- 2026-09-17: patched: Fixed in version 3.11.7