Critical Authorization Bypass in vm2 Package: External Package Allowlist Vulnerability
Summary
GHSA-6fvh-fgmg-3x7v: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. Affects vm2 versions < 3.11.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing untrusted code securely. It allows developers to run JavaScript code in a controlled context, preventing unauthorized access to the host environment. However, a vulnerability has been identified in the package's external package allowlist feature, which could lead to unauthorized code execution.
Vulnerability Detail
The vulnerability in vm2 arises from an incorrect authorization check in the external package allowlist. Instead of performing exact substring matching, the allowlist check uses non-exact matching, allowing attackers to bypass the restrictions by requiring a colliding package name that contains an allowlisted package substring. This could result in the execution of unauthorized host packages in the host context, leading to severe security implications, including data breaches and system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using package names that could collide with allowlisted packages. Additionally, review your code to ensure that no untrusted input can influence the package names being required.
Conclusion
The vm2 package has a critical vulnerability that allows attackers to bypass the external package allowlist, potentially leading to unauthorized code execution. It is essential to update to version 3.11.7 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability has a CVSS score of 9.9, indicating a critical severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities without any signup.
If exploited, this vulnerability could allow attackers to execute unauthorized code in the host environment, potentially leading to data breaches, system compromise, and other severe security issues.
Yes, the vulnerability is fixed in vm2 version 3.11.7 and later. It is crucial to update to this version to mitigate the risk.
If an immediate update is not possible, review your code for any potential package name collisions and avoid using untrusted input that could influence package loading.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
