PT-2026-37337 · Npm · Vm2
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
vm2 versions prior to 3.11.1
Description
When a
NodeVM is created with the nesting variable set to true, sandbox code can unconditionally use require('vm2') regardless of the outer VM's require configuration, including when require is set to false. This occurs because the nesting: true option interacts with the legacy module resolver in a way that silently overrides restrictions. An attacker can use access to vm2 to construct a new inner NodeVM with unrestricted require settings to execute arbitrary OS commands on the host. This issue affects applications running untrusted code inside a NodeVM with nesting: true, such as multi-tenant code execution platforms, notebook/REPL services, plugin systems, and CI sandboxing tools.Recommendations
Update to version 3.11.1.
As a temporary workaround, avoid setting the
nesting variable to true when running untrusted code.Exploit
Fix
Protection Mechanism Failure
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vm2