AIKIDO-2026-258902
vm2 is vulnerable to Exposure of Sensitive Information
100
Critical Risk
This Affects:
vm2TL;DR
When NodeVM expands its builtin allowlist with the '*' wildcard, it admits the host os and dns modules through a read-only proxy that forwards calls to the host. Sandbox code reads host process information via os.userInfo() and os.networkInterfaces(), and mutates host state via os.setPriority() and dns.setServers(). Replacing the host DNS resolver list redirects every subsequent host DNS lookup. The fix adds os and dns to the dangerous-builtins denylist so they are excluded from the sandbox.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run untrusted code in NodeVM with the os or dns builtins allowed.
Background info
vm2 is vulnerable to Exposure of Sensitive Information in versions 0.0.1 - 3.11.5.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant