AIKIDO-2026-10725
vm2 is vulnerable to Remote Code Execution
65
Medium Risk
This Affects:
vm2TL;DR
Host promise resolution can preserve host object identity through .then handling and null-prototype edge cases in sanitizer callbacks. Attackers unwrap those identities to obtain raw host objects inside guest reach. That violates the intended boundary for promises bridged into the sandbox. Sanitization is tightened so host objects cannot be smuggled through those resolution paths.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vm2 is vulnerable to Remote Code Execution in versions 0.0.1 - 3.10.5.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant