CVE-2021-23555: Sandbox bypass in vm2
Summary
CVE-2021-23555: Sandbox bypass in vm2. Affects vm2 versions < 3.9.6. Fixed in 3.9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is an npm package that provides a sandboxed environment for executing JavaScript code. It allows users to run untrusted code securely by isolating it from the host environment. The package is commonly used in applications that require dynamic code execution, such as online code editors or code evaluation platforms. However, versions of vm2 prior to 3.9.6 are vulnerable to a sandbox bypass, which can lead to the execution of arbitrary code on the host machine.
Vulnerability Detail
The vulnerability in vm2 arises from the direct access to host error objects generated by node internals during the generation of stack traces. This access can be exploited to bypass the sandbox and execute arbitrary code on the host machine. An attacker who can execute untrusted code within the vm2 sandbox can leverage this vulnerability to escape the sandbox and gain unauthorized access to the host machine. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code with the privileges of the host process.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.6
This is the first release that contains the fix.
npm install vm2@3.9.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the vm2 package is not immediately feasible, a possible workaround is to implement additional security measures to mitigate the risk of sandbox bypass. This can include implementing strict input validation and sanitization, as well as monitoring and restricting the resources and capabilities available to the sandboxed code. However, applying these workarounds may not provide complete protection and updating to the latest version of the package is still strongly recommended.
Conclusion
The vulnerability in vm2 allows for a sandbox bypass, enabling the execution of arbitrary code on the host machine. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. To mitigate this risk, it is crucial to update the vm2 package to version 3.9.6 or later. Implementing additional security measures and workarounds can provide temporary protection, but updating the package is the recommended long-term solution. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability allows an attacker to bypass the sandbox in vm2 and execute arbitrary code on the host machine. This can lead to unauthorized access, data breaches, and potential compromise of the entire system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to patch the vulnerability as soon as possible to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level. It is crucial to address this vulnerability promptly to mitigate the risk of exploitation.
For further support on vulnerability remediation and assistance in securing your application, you can reach out to info@devnack.com. Our team of experts can provide guidance and recommendations tailored to your specific needs.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
