AIKIDO-2026-10843
vm2 is vulnerable to Remote Code Execution (RCE)
100
Critical Risk
This Affects:
vm2TL;DR
NodeVM with nesting: true blocks only require: false, not omitted require, so the guard is skipped and defaults still disable require on the inner VM. Sandboxed code can require('vm2'), spawn a nested NodeVM with dangerous builtins, and run host commands. This is a bypass of an earlier nesting restriction fix. The patch rejects unsafe nesting when require is false or unset.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vm2 is vulnerable to Remote Code Execution (RCE) in versions 3.0.0 - 3.11.3.
How to fix this
Upgrade the vm2 library to the patch version.
Links
CVE Details
GitHub Release
Fix Commits
github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant