Critical TLS Trust Store Vulnerability in vm2 Package
Summary
GHSA-xq74-c7jx-8w5j: Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store. Affects vm2 versions >= 3.11.3, <= 3.11.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted JavaScript code securely. It allows developers to run code in a controlled manner, preventing access to the host environment. However, certain versions of vm2 have a critical vulnerability that exposes the host's TLS module to sandboxed code, potentially allowing attackers to manipulate the TLS trust store.
Vulnerability Detail
The vulnerability arises in vm2 versions from 3.11.3 to 3.11.6, where the host's TLS module is exposed to the NodeVM sandbox. This allows attackers to invoke tls.setDefaultCACertificates(), enabling them to replace the process-wide certificate authorities. If an attacker gains access to the allowed tls and url builtins, they can exploit URLSearchParams to create host-realm arrays and alter the TLS trust store. This manipulation can lead to host HTTPS clients accepting attacker-controlled certificates, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the tls and url builtins in your NodeVM sandboxed code until you can update to a patched version. This will help mitigate the risk of exploitation while you prepare for the update.
Conclusion
The vm2 package has a critical vulnerability that exposes the host's TLS module to sandboxed code, allowing potential manipulation of the TLS trust store. It is crucial to update to version 3.11.7 or later to mitigate this risk. Additionally, using Vulert can help you monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vm2 →
FAQ
vm2 versions from 3.11.3 to 3.11.6 are affected by this vulnerability.
The CVSS score of this vulnerability is 10.0, indicating a critical severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow attackers to manipulate the TLS trust store, leading to the acceptance of malicious certificates by host HTTPS clients.
Yes, as a temporary measure, avoid using the tls and url builtins in your NodeVM sandboxed code until you can update to a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
