Critical NodeVM Allowlist Bypass in vm2 Package Leading to Sandbox Escape
Summary
GHSA-wqg3-r97q-73xm: Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape. Affects vm2 versions >= 3.9.6, <= 3.11.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a virtual machine for executing untrusted code securely. It allows developers to run code in a sandboxed environment, isolating it from the host system. This package is widely used for applications that require executing user-generated code safely. However, a critical vulnerability has been identified that allows attackers to escape the sandbox under specific conditions, compromising the security that vm2 aims to provide.
Vulnerability Detail
The vulnerability arises from a NodeVM builtin allowlist bypass affecting vm2 versions >= 3.9.6 and <= 3.11.6. When the embedder allows the node:test builtin, the sandbox can be escaped on Node.js 24 and newer. The issue is due to the module.builtinModules exposing the key node:test, which is not protected by vm2's DANGEROUS_BUILTINS. Consequently, sandboxed code can call require('node:node:test'), gaining access to the host module and executing arbitrary JavaScript outside the sandbox using node:test.run(). This can lead to severe security breaches, as attackers can run malicious code in an unrestricted Node process.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the node:test builtin in your vm2 configuration until you can update to the patched version. Ensure that your require settings do not include node:test to mitigate the risk of sandbox escape.
Conclusion
The vm2 package has a critical vulnerability that allows sandbox escape through a NodeVM builtin allowlist bypass. It is essential to update to version 3.11.7 or later to mitigate this risk. Users should also consider using Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
vm2 versions >= 3.9.6 and <= 3.11.6 are affected by this vulnerability.
The CVSS score of this vulnerability is 9.9, indicating a critical severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update the vm2 package right away, avoid using the node:test builtin in your configuration as a temporary workaround.
The vulnerability allows attackers to execute arbitrary JavaScript in an unrestricted host Node process, potentially leading to data breaches, unauthorized access, and other severe security incidents.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
