Critical Native Code Execution Vulnerability in vm2 Package
Summary
GHSA-m7cq-7f2q-f9fh: Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through node:sqlite. Affects vm2 versions >= 3.11.3, <= 3.11.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted code. It allows developers to run code securely without exposing the host environment. However, certain versions of vm2 have a critical vulnerability that permits sandboxed plugins to execute native code, potentially compromising the host system.
Vulnerability Detail
The vulnerability arises from the exposure of Node.js's host node:sqlite module to code running in NodeVM. When this module is permitted, either explicitly or through a wildcard, it allows sandboxed code to create an in-memory DatabaseSync with extension loading enabled. This enables the execution of native libraries bundled in untrusted plugin packages, leading to arbitrary code execution outside the sandbox with the host process's privileges. The affected versions are vm2 3.11.3 through 3.11.6, and the issue is classified with a CVSS score of 9.9, indicating a critical severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the node:sqlite module in your sandboxed environment until you can update to the patched version. Additionally, review your code to ensure that no untrusted plugins are allowed to execute native code.
Conclusion
The vm2 package has a critical vulnerability that allows sandboxed plugins to execute native code, posing a significant risk to the host environment. It is essential to update to version 3.11.7 or later to mitigate this risk. Utilize tools like Vulert to monitor for vulnerabilities in your applications effectively.
See every vulnerability recorded for vm2 →
FAQ
The affected versions are vm2 3.11.3 through 3.11.6.
The vulnerability has a CVSS score of 9.9, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package immediately, avoid using the node:sqlite module in your sandboxed environment as a temporary workaround.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just package-lock.json, helping you maintain security without needing access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
