Executive brief
vm2 is a popular Node.js sandbox that restricts untrusted code execution. When configured with `builtin: ['*']` to expose all built-in modules, the sandbox fails to block the `os` and `dns` modules, allowing untrusted code to read sensitive host information (user credentials, network topology) and execute privileged write operations. Most critically, an attacker can hijack the host process's DNS resolver with a single line of code, redirecting all outbound network traffic through an attacker-controlled server to steal credentials or inject malicious packages.
Technical details
The vulnerability exists in `lib/builtin.js` where the `DANGEROUS_BUILTINS` set fails to list `os` and `dns`, causing them to pass the `isDangerousBuiltin()` filter when `builtin: ['*']` is used. These modules are then wrapped with `vm.readonly()` proxies that forward calls directly to the host realm. The `os` module leaks host process owner credentials (uid, gid, username, homedir, shell) via `os.userInfo()` and host network topology via `os.networkInterfaces()`. The `os.setPriority()` method mutates host process priority. More critically, `dns.setServers()` replaces the process-wide DNS resolver list—a single line of sandbox code can redirect all host DNS queries through an attacker-controlled server, enabling credential exfiltration, supply-chain attacks via npm registry hijacking, or authentication subversion. The readonly proxy cannot localize these operations because they inherently target host-process state. No authentication or user interaction is required; the threat model is untrusted sandbox code. Patched versions add both modules to `DANGEROUS_BUILTINS`.
Affected products
- vm2 vm2 <= 3.11.5
Timeline
- 2026-08-14: disclosed
- 2026-08-17: advisory
- 2026-08-17: patched: Patched in version 3.11.6