Unbounded Host Event-Loop Block in vm2: Timeout Option Bypass Vulnerability
Summary
GHSA-vjcv-9j33-wj62: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r4fx-v8hh-22mv. Affects vm2 versions < 3.11.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code while maintaining control over the execution context. However, certain versions of vm2 are vulnerable to a timeout option bypass, which can lead to denial of service due to unbounded blocking of the host event loop.
Vulnerability Detail
The vulnerability arises from the fact that vm2 versions prior to 3.11.7 do not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. Specifically, the timeout only applies to the _runScript() method, and the FinalizationRegistry and WeakRef are exposed to sandboxed code without modification. This allows sandboxed code to register a cleanup callback that can block the host event loop indefinitely when the garbage collector reclaims the object, leading to a denial of service. The issue is exacerbated by the unpredictable nature of garbage collection, which can vary based on memory pressure or specific runtime flags.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using FinalizationRegistry and WeakRef in your sandboxed code until you can upgrade to the patched version of vm2. This will help mitigate the risk of blocking the host event loop.
Conclusion
The vm2 package has a significant vulnerability that allows for a timeout option bypass, potentially leading to denial of service. It is crucial for developers using affected versions to upgrade to 3.11.7 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
vm2 versions 3.11.6 and earlier are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to denial of service, as the host event loop can be blocked indefinitely by malicious sandboxed code.
Yes, as a temporary measure, avoid using FinalizationRegistry and WeakRef in your sandboxed code until you can upgrade to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
