Critical Remote Code Execution Vulnerability in vm2 Package
Summary
GHSA-29x6-9qh5-83gg: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j3hm-6rg5-mchv. Affects vm2 versions < 3.11.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run code securely by isolating it from the host environment. However, a significant vulnerability has been identified that can lead to unrestricted access to the host filesystem and remote code execution (RCE) when specific configurations are not properly set.
Vulnerability Detail
The vulnerability arises from the use of the require.external feature in vm2 without an explicit require.root setting that excludes node_modules. This misconfiguration allows sandboxed code to require the vm2 package itself, instantiate an unrestricted NodeVM instance, and execute arbitrary commands on the host operating system using child_process. The potential ramifications include unauthorized access to sensitive data, system compromise, and complete control over the affected server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using require.external without setting require.root to a safe directory. Ensure that your configuration explicitly restricts access to sensitive directories, such as node_modules, to mitigate the risk of exploitation.
Conclusion
The vm2 package has a critical vulnerability that allows remote code execution when misconfigured. It is crucial to update to the patched version 3.11.7 or later and to implement workarounds to mitigate risks until an update can be applied. Regular monitoring with tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can provide real-time alerts. You can also check your application using the Vulert playground without any signup.
Failure to address this vulnerability can lead to unauthorized access to the host filesystem, data breaches, and complete control over the affected server, posing significant security risks.
Yes, you should upgrade to version 3.11.7 or later to ensure that the vulnerability is patched.
If immediate updates are not possible, implement the recommended workaround by configuring require.root to restrict access to sensitive directories and avoid using require.external.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
