vm2@3.0.1

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through the setupSandboxScript bootstrap in lib/vm.js and lib/setup-sandbox.js. An attacker can read the sandbox’s VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL object by supplying computed property accesses such as globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'], Reflect.get, descriptor APIs, or own-property enumeration. This exposes the live internal state object to sandboxed code, including helper methods such as handleException and wrapWith, breaking the sandbox’s protection against direct access to vm2 internals and enabling further abuse of those exposed primitives.

Notes: This is a complementary fix for CVE-2026-44003

Upgrade vm2 to version 3.11.2 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Symlink Attack via the isPathAllowed path check in lib/resolver-compat.js. An attacker can execute code outside the configured require.root by placing or using a symlink inside the allowed root and causing require() to load it. The resolver compares a lexically resolved filename against the configured root with a string prefix check, while Node’s native module loader follows symlinks to the target path. In context: 'host', this lets an attacker run outside-root modules with host privileges, leading to remote code execution and compromise of the host process.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through the transformer fast-path in the source instrumentation logic. An attacker can expose the internal VM state and reach the wrapWith/handleException/import-related leak by supplying JavaScript that references VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL with Unicode escape sequences such as \u0056 or \u{56} so the raw substring check misses it.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through the globalPromise.prototype.then onFulfilled wrapper in the Promise bridge. An attacker can supply a host Promise that resolves to an unmapped host object, such as an Object.create(null) instance or another host-realm class vm2 does not proto-map, and then invoke .then() from the sandbox to receive that object unwrapped. If the resolved value contains attacker-controlled methods, those methods execute in the host realm without passing through the bridge, allowing the attacker to run host-side code and break the isolation expected by the user.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Information Exposure via the sandbox CallSite handling. An attacker can leak absolute host filesystem paths by causing error.stack or getEvalOrigin() to run on sandbox frames, exposing host-realm filenames embedded in stack traces and eval-origin strings to sandbox code.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Buffer.alloc family in lib/setup-sandbox.js. An attacker can crash the host process by supplying a large allocation size to Buffer.alloc, Buffer.allocUnsafe, Buffer.allocUnsafeSlow, or the deprecated Buffer(N) / new Buffer(N) forms inside sandboxed code. These calls execute as a single synchronous host C++ allocation, so a small sandbox payload can force a large RSS spike that exhausts memory in constrained deployments such as containers or serverless runtimes.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Uncaught Exception through the Promise constructor when an unhandled rejection propagates from the sandboxed environment to the host process. An attacker can cause the host process to crash by executing code that triggers an unhandled rejection, such as by setting Error.name to a Symbol() and accessing .stack within the executor function. This can be exploited remotely via a single crafted request, resulting in a persistent denial-of-service condition for all users.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the proxy trap methods in createBridge in the bridge handler code. An attacker can leak a handler using util.inspect({showProxy:true}) and invoke its trap methods directly with a forged target, then walk the host prototype chain to recover privileged symbols and achieve code execution. This enables sandbox escape and lets untrusted code execute with the privileges of the host process.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the lib/bridge.js value-conversion paths. An attacker can extract the host Symbol.for('nodejs.util.inspect.custom') or Symbol.for('nodejs.rejection') by calling host reflection APIs on Buffer.prototype and then using that symbol as a computed property key to trigger host-side util.inspect or rejection handling with attacker-controlled callbacks. The vulnerable bridge passes raw host symbol primitives into sandbox code from host return values, iterator results, descriptor objects, and throw paths, allowing the dangerous symbol to survive into plain sandbox objects and be reused as a live key. In the affected VM environment, this leads to sandbox escape and arbitrary code execution in the host process.

Note: Constructor access was partially blocked in version 3.10.5, but this bypasses the protection introduced there.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the inspect function. An attacker can execute arbitrary commands on the host system by escaping the sandbox environment.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the SuppressedError. An attacker can execute arbitrary code outside the intended sandbox environment by leveraging this flaw.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the vm2.run function. An attacker can execute arbitrary commands on the host system by escaping the sandbox environment and gaining access to the host process object.

Upgrade vm2 to version 3.10.5 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the __lookupGetter__ method and improper context isolation. An attacker can execute arbitrary commands on the host system by escaping the sandbox and leveraging host context methods.

Upgrade vm2 to version 3.11.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources due to the unsafe usage of the .call() with globalPromise.prototype.then callback function. An attacker can execute arbitrary code outside the intended sandbox by overwriting Function.prototype.call inside the sandbox that bypass the intended security controls.

Note:

This issue can be mitigated by migrating to 'isolated-vm' for stronger isolation based on V8 Isolates and using OS-level isolation (Docker, gVisor, Firecracker) instead of application-level sandboxes.

Upgrade vm2 to version 3.10.2 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient checks which allow an attacker to escape the sandbox.

Note:

According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.

Upgrade vm2 to version 3.10.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) such that the Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox.

Note:

According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.

Upgrade vm2 to version 3.10.0 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Sandbox Bypass by abusing an unexpected creation of a host object based on the maliciously crafted specification of Proxy. Exploiting this vulnerability allows an attacker to gain remote code execution rights on the host running the sandbox via the Function constructor.

Upgrade vm2 to version 3.9.18 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the inspect method of vm.js, which allows write permissions. Exploiting this vulnerability allows an attacker to edit options for the console.log command.

Upgrade vm2 to version 3.9.18 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions due to allowing attackers to raise an unsanitized host exception inside handleException() which can be used to escape the sandbox and run arbitrary code in host context.

Upgrade vm2 to version 3.9.17 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Sandbox Escape. There exists a vulnerability in source code transformer (exception sanitization logic), allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.

Upgrade vm2 to version 3.9.16 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Sandbox Escape due to improper handling of host objects passed to Error.prepareStackTrace in case of unhandled async errors.

Upgrade vm2 to version 3.9.15 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Upgrade vm2 to version 3.9.10 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Sandbox Bypass via indirect access to host.Object during preparation of stacktraces, which can lead to execution of arbitrary code on the host machine.

Upgrade vm2 to version 3.9.11 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

Upgrade vm2 to version 3.9.6 or higher.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.

PoC

const {VM} = require("vm2");
let vmInstance = new VM();

let code = `    
    res = eval('import(\\'./foo.js\\');')    
    res.__proto__.__proto__.polluted = res.__proto__.__proto__.toString.constructor("return this")().process.mainModule.require("child_process").execSync("touch HACKED").toString();
`;
vmInstance.run(code);
console.log(polluted);

Upgrade vm2 to version 3.9.4 or higher.