vm2 npm Package Vulnerability: Critical Sandbox Escape Risk
- Severity
- CRITICAL
- CVSS
- 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Affected component
- vm2 (npm)
- Affected versions
- < 3.11.3 or < 3.11.2 or < 3.11.0 or < 3.9.10 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.9.6 or < 3.11.4 or < 3.9.15 or < 3.11.1 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.2 or < 3.11.4 or < 3.11.2 or < 3.11.2 or < 3.11.4 or < 3.10.0 or < 3.9.17 or >= 3.10.5, < 3.11.0 or >= 3.10.5, <= 3.10.5 or < 3.10.5 or <= 3.9.19 or < 3.11.0 or < 3.11.0 or < 3.11.4 or < 3.11.4 or < 3.11.0 or < 3.9.11 or < 3.9.18 or < 3.11.4 or < 3.11.0 or < 3.10.5 or < 3.11.4 or < 3.9.4 or < 3.11.4 or < 3.11.0 or < 3.11.0 or < 3.11.4 or >= 3.9.6, < 3.11.0 or < 3.6.11 or < 3.9.18 or < 3.11.0 or < 3.9.16
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the vm2 npm package. This vulnerability, which reportedly enables sandbox escape to remote code execution, affects versions <= 3.11.3.
What happened
The vm2 npm package is under investigation for a critical vulnerability. This vulnerability, tracked as GHSA-M283-3H24-438V, involves a missing error.cause sanitization that enables sandbox escape to remote code execution. The affected versions are <= 3.11.3. This vulnerability has a CVSS score of 9.9, indicating a critical severity level. It is not yet confirmed if this vulnerability has been exploited in the wild.
The vulnerability allows for a sandbox breakout, which can lead to remote code execution. This means that an attacker could potentially execute arbitrary code on a system that is using an affected version of the vm2 package. The vulnerability has been reported and is being investigated, but no official fix has been published yet.
What to do about it
- Check your project dependencies for any versions of the vm2 npm package that are <= 3.11.3.
- If you are using an affected version, upgrade to a version of vm2 that includes the fix for this vulnerability.
- Monitor the primary sources for updates on this vulnerability and any official patches that may be released.
- Consider implementing additional security measures to mitigate the risk of remote code execution until a patch is available.
How 0Day would have caught this
vm2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your project dependencies include any versions of the vm2 npm package that are <= 3.11.3.
What should I do right now?
Check your project dependencies for any affected versions of the vm2 package and upgrade to a version that includes the fix for this vulnerability. Monitor the primary sources for updates.
Is there an official patch available?
No official patch has been published yet. Monitor the primary sources for updates on any official fixes.
Sources
- [GHSA-cfcw-xp6x-25gj] vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
- [GHSA-m283-3h24-438v] VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
- [GHSA-m5w8-4gq2-6f8x] vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)