CVE-2019-10761: vm2 Sandbox Escape Vulnerability
Summary
CVE-2019-10761: vm2 before 3.6.11 vulnerable to sandbox escape. Affects vm2 versions < 3.6.11. Fixed in 3.6.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is an npm package that provides a sandboxed environment for executing JavaScript code. It allows users to run untrusted code in a controlled environment, preventing it from accessing sensitive resources or causing harm. However, a vulnerability in versions prior to 3.6.11 allows an attacker to escape the sandbox and execute arbitrary code on the host system.
Vulnerability Detail
The vulnerability arises from a RangeError exception that can be triggered from the host context instead of the sandboxed context. By causing an infinite recursion and reaching the stack call limit, the attacker can manipulate the returned object to reference the mainModule property of the host code. This allows them to spawn a child_process and execute arbitrary code, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.11
This is the first release that contains the fix.
npm install vm2@3.6.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package to mitigate the risk.
Conclusion
The vm2 package prior to version 3.6.11 is vulnerable to a sandbox escape vulnerability that allows an attacker to execute arbitrary code on the host system. To mitigate this risk, users should update to version 3.6.11 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vm2 →
FAQ
vm2 is an npm package that provides a sandboxed environment for executing JavaScript code. It allows users to run untrusted code in a controlled environment, preventing it from accessing sensitive resources or causing harm.
The vulnerability allows an attacker to escape the sandbox and execute arbitrary code on the host system. This can lead to unauthorized access, data breaches, or compromise of the entire system.
To fix this vulnerability, update the vm2 package to version 3.6.11 or later. This version includes a fix for the RangeError exception and prevents the sandbox escape.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package to mitigate the risk.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-wf5x-cr3r-xr77.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
