Remote Code Execution (RCE) Affecting vm2 package, versions <3.11.7

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) in its external module loader, lib/resolver-compat.js (makeResolverFromLegacyOptions, CustomResolver.isPathAllowed, and CustomResolver.loadJS), where two unsafe defaults combine: when require.root is undefined isPathAllowed returns true for every path, and the context parameter defaults to 'host' so a resolved module is loaded through the real Node.js require() rather than through the sandbox. An attacker can execute arbitrary OS commands via child_process, read and write arbitrary files, and fully circumvent the outer sandbox by submitting sandboxed code that requires vm2's own installed package to obtain unwrapped classes, then instantiates an unrestricted nested NodeVM from them and runs host code inside it. This requires the application to enable require.external: true without setting require.root to exclude node_modules, and the exposure is not limited to an obviously misconfigured setup, because even the documented "Quick Examples" configuration of root: './' looks restrictive yet still resolves ./node_modules/vm2 and is therefore exploitable.

• GitHub Advisory
• GitHub Commit
• GitHub Release
• Vulnerability Report