Description

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-17T14:17:59.143Z",
  "pubdate": "2026-09-17T14:17:59.143Z",
  "executiveSummary": "This vulnerability involves a sandbox escape in the vm2 library, specifically affecting versions 3.11.3 through 3.11.6 when NodeVM is configured to allow require('https').\nThe issue manifests as a prototype-based proxy bypass, where sandboxed code gains access to the host process's real https.globalAgent instance.\nBy registering listeners on the agent's events, an attacker within the sandbox can intercept sensitive traffic handled by the host process.\nThe impact includes the exfiltration of sensitive information such as Authorization headers, private destination details, and full response bodies from unrelated host-level HTTPS requests.\nFurthermore, the attacker can leverage stolen credentials to perform unauthorized, authenticated requests on behalf of the host.\nThis represents a critical failure in the isolation boundaries provided by vm2, allowing a contained sandbox to escalate privileges to the host context through event-loop-driven data leakage.\nExploitation requires the attacker to successfully execute code within a compromised NodeVM instance where the HTTPS module has been explicitly enabled.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the https.globalAgent within the vm2 builtin loader. While vm2 attempts to wrap host modules in a read-only proxy to enforce isolation, the implementation fails to prevent the propagation of method calls for inherited prototype functions.\nSpecifically, when sandboxed code invokes Agent.prototype.on(), the request is forwarded to the underlying host object. This allows the sandbox to register a malicious event listener directly on the host's https.globalAgent instance.\nThe attack flow proceeds as follows: 1) The attacker instantiates a NodeVM with require('https') permitted. 2) The attacker calls the 'on' method on the https.globalAgent proxy to monitor the 'free' event. 3) The vulnerability remains dormant until the host process initiates an unrelated HTTPS request. 4) When the host request completes and releases the connection back to the agent's pool, the 'free' event is triggered, passing the live host request options and the raw TLSSocket to the attacker-supplied listener.\nBy capturing the TLSSocket, the attacker gains full control over the connection lifecycle. They can extract sensitive metadata such as HTTP Authorization headers, destination hostnames, and port numbers. Furthermore, by attaching additional data listeners to the active TLSSocket, the attacker can intercept and read the plaintext content of subsequent host response bodies, even if those responses were not intended for the sandbox.\nAdditionally, because the agent maintains a live connection pool, the attacker can perform authenticated requests using the same connection context, effectively hijacking the host's credentials and session state. This bypasses all intended sandbox restrictions, as the interaction occurs at the object prototype level, rendering the read-only proxy protection ineffective for event-driven callbacks.\nThis issue is present in versions 3.11.3 through 3.11.6. It does not require host-level authentication or high-level privileges for the attacker to initiate, provided they have the ability to execute arbitrary code within the sandboxed environment. There are no specialized network requirements, as the attack relies on the existing HTTPS traffic generated by the host process."
}