AIKIDO-2026-10731
vm2 is vulnerable to Remote Code Execution
98
Critical Risk
This Affects:
vm2TL;DR
Exception handling in the sandbox bridge can treat null-prototype thrown values in a way that leaks host-side inspection surfaces. Guest code can pair that with proxied and unproxied views of the same object to recover dangerous constructors. That breaks the intended isolation boundary and can lead to host code execution. The fix restores safer bridging so bridge.from() paths cannot be abused for host-function unwrapping in this scenario.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vm2 is vulnerable to Remote Code Execution in versions 0.0.1 - 3.11.1.
How to fix this
Upgrade the vm2 library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant