Executive brief
vm2 is a popular Node.js virtual machine library used to safely execute untrusted JavaScript code in an isolated sandbox. A flaw in how vm2 processes module denial policies allows attackers to bypass security restrictions and gain access to dangerous system APIs like child_process, which provides command execution capabilities. An attacker can escape the sandbox's intended restrictions by requiring modules using alternate naming conventions.
Technical details
vm2's NodeVM normalizes node:-prefixed builtin module specifiers during require() resolution by stripping the prefix before loading, but does not apply the same normalization when evaluating negative (deny) entries in wildcard builtin policies. A deny rule like -node:child_process is matched by exact string comparison against canonical names (e.g., child_process), causing the comparison to fail. An attacker can require('child_process') or require('node:child_process') to bypass the intended denial and gain access to host process-spawning APIs such as execSync and spawn, effectively achieving command execution within the sandbox. The vulnerability affects NodeVM configurations using wildcard builtin policies with node:-prefixed negative entries. Fixed in vm2 3.11.7 by canonicalizing builtin names before allow/deny comparison.
Affected products
- vm2 vm2 through 3.11.6
Timeline
- 2026-08-24: disclosed
- 2026-09-17: advisory
- 2026-09-17: patched: Fixed in vm2 3.11.7