Description

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-17T14:18:00.827Z",
  "pubdate": "2026-09-17T14:18:00.827Z",
  "executiveSummary": "The vm2 sandbox environment is susceptible to an incorrect authorization vulnerability due to flawed validation logic within its external package allowlist mechanism. Specifically, the library utilizes non-exact substring matching when verifying package names, failing to enforce strict boundary validation. This architectural flaw allows an attacker to bypass security restrictions by requesting a malicious package that contains an allowlisted package name as a substring. By successfully tricking the sandbox into interpreting the request as a match, the attacker can force vm2 to load and execute unauthorized host-level packages within the privileged host context. This vulnerability affects all versions of vm2 prior to 3.11.7. The security implications are severe, as this bypass effectively nullifies the isolation boundaries intended by the sandbox, granting an attacker the ability to execute arbitrary code with the permissions of the host process. Exploitation requires only the ability to manipulate package imports within the sandboxed environment, posing a critical risk to applications relying on vm2 for secure code execution.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the package allowlist verification function in vm2, which relies on improper string matching logic. Instead of performing a strict, full-string equality check or enforcing boundary delimiters (such as ensuring the package name matches precisely from start to end), the system employs a lax substring check. This vulnerability is triggered when the sandboxed code initiates a 'require' call for an external package.\nThe exploitation flow begins with the attacker identifying a legitimate, allowlisted package name. Subsequently, the attacker registers or utilizes a malicious package that contains the allowlisted string as a subset of its own name—for example, if 'fs' is allowlisted, an attacker might attempt to load a package named 'my-fs-bypass'. Because the validation logic performs a simple contains() or partial match check, the input 'my-fs-bypass' is incorrectly validated against the 'fs' allowlist.\nUpon successful validation of the malicious package name, vm2 proceeds to load the requested module. Since the validation has been bypassed, the sandbox treats the unauthorized module as a trusted entity. The module is then resolved and required within the host context rather than being blocked or restricted as expected. This allows the attacker to break out of the sandbox confinement.\nOnce the host package is loaded, the payload behavior typically involves executing arbitrary JavaScript with the host's system privileges. Because the execution occurs within the host context, the malicious package can interact with sensitive APIs, file systems, or network sockets that are otherwise prohibited by the vm2 sandbox configuration. The post-exploitation impact includes full system compromise, unauthorized data exfiltration, or the potential for lateral movement within the hosting infrastructure. The vulnerability does not require authentication or elevated privileges beyond the initial ability to execute code within the restricted VM instance, and it does not rely on specific network exposure, as it is a logic flaw inherent to the local resolution process of the vm2 module loader."
}