Critical Vulnerability in vm2 Package: Arbitrary Native Code Execution via Crypto Built-in
Summary
GHSA-6jgm-4w45-vh8j: Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine. Affects vm2 versions >= 3.11.3, <= 3.11.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run code securely without exposing the host environment. However, versions 3.11.3 to 3.11.6 have a critical vulnerability that exposes the host Node.js crypto module, allowing attackers to execute arbitrary native code within the host process.
Vulnerability Detail
The vulnerability arises from the exposure of the Node.js crypto module to a NodeVM sandbox when the crypto built-in is allowed. Although the module is presented via a read-only proxy, its callable exports execute with host-process authority. This means that sandboxed JavaScript can invoke crypto.setEngine() with a path to an attacker-controlled native library. When OpenSSL attempts to load this library, it executes native code in the host process before validating the engine symbol, leading to a sandbox escape and arbitrary code execution. This vulnerability is critical, with a CVSS score of 9.9, and does not require access to other Node.js modules like fs or process.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the crypto built-in in the vm2 sandbox until you can update to the patched version. Additionally, review your code to ensure that untrusted code does not have access to sensitive modules.
Conclusion
The vm2 package has a critical vulnerability that exposes the host Node.js crypto module, allowing for arbitrary native code execution. It is essential to update to version 3.11.7 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for vm2 →
FAQ
Versions 3.11.3 to 3.11.6 of the vm2 package are affected.
The vulnerability allows attackers to execute arbitrary native code in the host process, leading to a potential compromise of the entire application.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, you can temporarily avoid using the crypto built-in in the vm2 sandbox until you can update to a safe version.
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
