AIKIDO-2026-10843
vm2 is vulnerable to Remote Code Execution (RCE)
100
Critical Risk
This Affects:
vm2TL;DR
NodeVM with nesting: true blocks only require: false, not omitted require, so the guard is skipped and defaults still disable require on the inner VM. Sandboxed code can require('vm2'), spawn a nested NodeVM with dangerous builtins, and run host commands. This is a bypass of an earlier nesting restriction fix. The patch rejects unsafe nesting when require is false or unset.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vm2 is vulnerable to Remote Code Execution (RCE) in versions 3.0.0 - 3.11.3.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant