Improper Control of Dynamically-Managed Code Resources Affecting vm2 package, versions <3.11.4

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the NodeVM constructor in lib/nodevm.js. An attacker can obtain host code execution by creating a nested VM with nesting: true and an omitted or falsy require value, then using the injected vm2 builtin to spawn an inner NodeVM with attacker-chosen require settings and reach child_process. The vulnerable configuration produces a NESTING_OVERRIDE-only resolver whose sole builtin is vm2, so sandboxed code can load vm2 even when the outer VM was intended to deny requires. This breaks the user's expectation that a nested sandbox remains constrained and can lead to full compromise of the host process.

• GitHub Advisory
• GitHub Commit