Critical RCE Vulnerability in vm2 Package: NodeVM Nesting Guard Bypass
Summary
GHSA-9fxx-mv6c-j5xp: Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE. Affects vm2 versions >= 3.11.4, <= 3.11.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a widely used sandboxing library for executing untrusted Node.js code securely. It allows developers to run potentially harmful code in a controlled environment, preventing access to the host system. However, certain versions of vm2 have a critical vulnerability that compromises this security feature, allowing attackers to escape the sandbox and execute arbitrary commands on the host system.
Vulnerability Detail
The vulnerability arises from a flaw in the NodeVM constructor in vm2 versions >= 3.11.4 and <= 3.11.6. The constructor incorrectly evaluates the 'requireOpts' parameter, allowing an array-shaped 'require' value (e.g., require: []) to bypass the nesting guard. This oversight enables an attacker to create an inner NodeVM with a custom built-in allowlist, leading to remote code execution (RCE) with the privileges of the host Node.js process. The severity of this vulnerability is underscored by its CVSS score of 9.0, indicating a critical risk to systems using affected versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the 'require' option with an array-shaped value when configuring NodeVM. Instead, provide a valid object for the 'require' option that explicitly defines the required modules.
Conclusion
The vm2 package has a critical vulnerability that allows for remote code execution due to improper handling of the 'require' option in certain versions. It is essential to update to version 3.11.7 or later to mitigate this risk. Users should also consider using Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability allows attackers to escape the sandbox created by vm2 and execute arbitrary commands on the host system due to improper handling of the 'require' option.
The vulnerability affects vm2 versions >= 3.11.4 and <= 3.11.6.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
If an immediate update is not possible, avoid using the 'require' option with an array-shaped value as a temporary workaround.
The CVSS score of this vulnerability is 9.0, indicating a critical risk level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
