Critical Authorization Bypass in vm2 Package Leading to Sandbox Escape
Summary
GHSA-c9wr-qm7p-p6vc: Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries. Affects vm2 versions < 3.12.2. Fixed in 3.12.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a widely used Node.js library that provides a secure sandbox for executing untrusted code. It allows developers to run JavaScript code in a controlled environment, isolating it from the host application. This feature is crucial for applications that need to execute user-generated code safely. However, a critical vulnerability has been identified in versions prior to 3.12.2, which could allow unauthorized access to the host environment.
Vulnerability Detail
The vulnerability arises from an authorization bypass in the NodeVM external-module resolver of vm2. When an embedder configures 'require.external' with a custom resolver and 'context: host', the LegacyResolver.customResolve method incorrectly records the resolved module directory without enforcing path boundaries. This flaw allows untrusted guest code to require an allowlisted module and subsequently access a non-allowlisted sibling module, leading to a sandbox escape and potential arbitrary code execution in the host context. The CVSS score for this vulnerability is 9.0, indicating a critical severity level.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using custom resolvers with 'require.external' in the vm2 configuration until you can update to the patched version. This will help mitigate the risk of unauthorized access to the host environment.
Conclusion
The vm2 package has a critical vulnerability that allows for an authorization bypass, potentially leading to sandbox escapes and arbitrary code execution. It is essential to update to version 3.12.2 or later to mitigate this risk. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for vm2 →
FAQ
vm2 is a Node.js library that provides a secure sandbox for executing untrusted JavaScript code, allowing developers to run user-generated code safely.
The vulnerability allows untrusted code to bypass authorization checks and access non-allowlisted modules, leading to potential sandbox escapes and arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid using custom resolvers with 'require.external' in your vm2 configuration as a temporary workaround.
The CVSS score of this vulnerability is 9.0, indicating a critical severity level that requires prompt attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
