AIKIDO-2026-170953
vm2 is vulnerable to Improper Access Control
40
Medium Risk
This Affects:
vm2TL;DR
Objects protected with the sandbox's freeze() and readonly() helpers remain mutable when they expose accessor properties. Sandboxed code retrieves the accessor descriptor and invokes the setter directly, which routes through the bridge and unwraps the read-only proxy to the underlying host object. This lets sandboxed code mutate host object state that was intended to be immutable, though plain data properties stay protected. The fix closes the setter-invocation path for frozen and read-only accessor-backed properties.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on freeze() or readonly() to protect host objects that expose accessor properties.
Background info
vm2 is vulnerable to Improper Access Control in versions 3.9.6 - 3.11.6.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant