AIKIDO-2026-339424

vm2 is vulnerable to Remote Code Execution

Remote Code ExecutionGHSA-j3hm-6rg5-mchv Published Yesterday

100

Critical Risk

This Affects:

vm2

0.0.1 - 3.11.6

Fixed in 3.11.7

Are you affected? Scan for Free

TL;DR

When require.external is enabled but no require.root is configured, the resolver defaults to host context with unrestricted root paths, so its path check returns true and it runs the real Node require(). Sandboxed code can host-require arbitrary files, including the installed vm2 package, obtain the unwrapped NodeVM and VM classes, and build an unrestricted nested instance that runs child_process. 3.11.7 blocks requiring host vm2 itself and warns once at construction, but it does not refuse the configuration or close host-require of other paths. Closing the remaining escape requires setting require.root to a directory boundary and/or require.context to sandbox.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you enable require.external without setting require.root, or you set require.root to a path that still includes modules you do not intend to execute in the host process (for example the project node_modules tree).

Background info

vm2 is vulnerable to Remote Code Execution in versions 0.0.1 - 3.11.6.

How to fix this

Upgrade the vm2 library to the patch version and, whenever require.external is enabled, set require.root to a directory that cannot reach untrusted packages and/or set require.context to sandbox. Omitting require.root or using a project-root value such as ./ is not sufficient.