Critical Sandbox Escape Vulnerability in vm2 Package
Summary
GHSA-gg6f-mhqm-f7gp: Duplicate Advisory: Sandbox Escape (NodeVM). Affects vm2 versions < 3.11.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a widely used Node.js library that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code without risking the security of the host application. However, prior to version 3.11.8, vm2 contained a critical vulnerability that could allow attackers to escape the sandbox and execute arbitrary code in the host context.
Vulnerability Detail
The vulnerability in vm2 arises from a sandbox escape in the NodeVM implementation. Attackers can exploit this flaw by accessing the host's proto getter/setter through console._stdout and console._stderr. This allows them to overwrite EventEmitter.prototype.emit, enabling the triggering of process events that can execute code with the process context. The ramifications of this vulnerability are severe, as it bypasses the intended restrictions of the sandbox, potentially leading to unauthorized access and control over the host system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict the use of console._stdout and console._stderr in your application until you can update to the patched version. This can help mitigate the risk of exploitation while you prepare for the update.
Conclusion
The vm2 package has a critical vulnerability that allows for sandbox escape, potentially compromising the host system. It is essential to update to version 3.11.8 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for vulnerabilities in your applications.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability has a CVSS score of 10.0, indicating it is critical and poses a significant risk to affected systems.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
If exploited, this vulnerability could allow attackers to execute arbitrary code on the host system, leading to data breaches, unauthorized access, and potential system compromise.
Yes, you can restrict the use of console._stdout and console._stderr in your application as a temporary measure to reduce the risk of exploitation.
For more details, you can refer to the original advisory linked to this vulnerability, which provides in-depth technical information.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
