AIKIDO-2026-290529

vm2 is vulnerable to Sandbox Escape

Sandbox EscapeGHSA-5h3f-q97h-ccvc Published 5 days ago

100

Critical Risk

This Affects:

vm2

0.1.0 - 3.12.1

Fixed in 3.12.2

Are you affected? Scan for Free

TL;DR

NodeVM's custom resolver in LegacyResolver.customResolve stores an allowlisted package as a raw ^<path> regex prefix with no path boundary, so resolving foo to .../node_modules/foo also allows siblings such as .../node_modules/foo2/index.js. A {module, path} answer allows the whole search directory. Guest code that requires such a sibling runs its top-level code in the host realm under the default context: 'host', which bypasses the external module allowlist and leads to host code execution. The fix stores resolver answers as boundary matched base paths, allows only the resolved package directory, refuses absolute or ..-bearing module answers, and withdraws an authorization when its load fails.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you configure NodeVM with a custom require.resolver and an external module allowlist.