AIKIDO-2026-916119
vm2 is vulnerable to Improper Access Control
72
High Risk
This Affects:
vm2TL;DR
vm2's NodeVM exposes a sanitized copy of the crypto builtin when an embedder allowlists it. The sanitizer blocks setEngine but leaves crypto.setFips callable, and the read only wrap forwards the call to the host with full authority. Guest code can flip the FIPS mode of the entire host process, disrupting later host cryptographic operations that rely on the previous mode. The fix replaces setFips with a throwing stub alongside setEngine while leaving getFips and the rest of crypto intact.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use NodeVM with the crypto builtin allowlisted.
Background info
vm2 is vulnerable to Improper Access Control in versions 3.11.7 - 3.12.0.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.