Description

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with a filesystem path to an attacker-supplied native library (for example, one bundled in an untrusted plugin package already written to disk); OpenSSL asks the operating-system dynamic loader to load the file, and the library's constructor executes native code in the host process before engine-symbol validation rejects it. Exploitation requires only the crypto builtin and does not require fs, process, module, child_process, worker_threads, vm, or inspector access, resulting in a sandbox escape and arbitrary native code execution. Fixed in 3.11.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-17T14:17:58.970Z",
  "pubdate": "2026-09-17T14:17:58.970Z",
  "executiveSummary": "The vm2 library, specifically versions 3.11.3 through 3.11.6, contains a critical sandbox escape vulnerability involving the Node.js crypto module.\nThe vulnerability occurs because the crypto builtin is exposed to the NodeVM sandbox via a recursive read-only proxy that fails to prevent the execution of functions with host-process authority.\nThis flaw allows a sandboxed attacker to achieve arbitrary native code execution on the host machine.\nExploitation is highly restricted in terms of prerequisites, requiring only that the crypto builtin be enabled in the NodeVM configuration.\nAttackers do not require access to sensitive modules such as fs, process, module, child_process, worker_threads, vm, or inspector to compromise the host.\nThe risk implication is total sandbox breakout and complete host system compromise, as the vulnerability leverages the OpenSSL engine loading mechanism to execute arbitrary native code.\nThis vulnerability is addressed in version 3.11.7, and immediate upgrading is required for any environment utilizing vm2 with crypto functionality enabled.",
  "technicalDetails": "The vulnerability stems from the flawed implementation of the NodeVM sandbox, which exposes the host's Node.js crypto module to the untrusted guest environment when the 'crypto' builtin is permitted.\nWhile vm2 attempts to encapsulate the crypto module using a recursive read-only proxy, the callable exports of the module retain the authority of the underlying host process.\nThe core of the exploit lies in the crypto.setEngine() function. By invoking this function from within the sandbox, an attacker can supply a filesystem path pointing to a malicious native library.\nWhen crypto.setEngine() is called with a path, the OpenSSL library instructs the operating system's dynamic loader to load the specified file as a dynamic library.\nThe vulnerability trigger occurs during the library loading phase: the operating system executes the library's constructor/initializer code immediately upon loading.\nCritically, this execution happens before OpenSSL performs validation of the library's engine-specific symbols. Even if the subsequent validation fails and the engine is rejected, the malicious constructor code has already executed with the privileges of the host Node.js process.\nBecause the attacker can leverage files already present on the filesystem (such as those bundled in untrusted plugin packages), they do not need additional filesystem access modules like 'fs' to place the payload.\nThe attack flow follows these steps: 1) The attacker gains execution within a NodeVM sandbox where 'crypto' is enabled. 2) The attacker calls crypto.setEngine(path_to_malicious_library). 3) The host process invokes the OS dynamic loader to map the malicious library. 4) The loader executes the library's entry point, granting the attacker arbitrary native code execution on the host.\nThis impact results in a complete sandbox escape, bypassing the security boundaries intended to isolate untrusted user-provided JavaScript code from the host operating system.\nThe vulnerability affects vm2 versions 3.11.3 through 3.11.6. It does not require network exposure, specific authentication, or additional elevated privileges beyond what the sandbox environment provides at the time of execution."
}