Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability in the vm2 Node.js sandbox allows untrusted code to execute arbitrary commands on the host system. This issue arises when the sandbox is configured for nesting and can bypass security restrictions. Any application using vm2 with this configuration is fully compromised and should be updated immediately.
- Allows arbitrary code execution.
- Affects applications running untrusted code.
- Requires existing access to the sandbox.
Attack Path
How an attacker could exploit the issue
An attacker with privileged access to a Node.js application using a vulnerable version of `vm2` can exploit this by creating nested virtual machines. The inner sandbox then bypasses security restrictions, allowing it to execute arbitrary operating system commands on the host. This effectively grants the attacker full control over the compromised system.
- Requires privileged access.
- Targets `vm2` sandbox with nesting enabled.
- Unrestricted `require` in inner VM.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability is highly concerning for applications using vm2 to sandbox untrusted code, as it allows for full host command execution by bypassing sandbox restrictions. Attackers would be motivated to weaponize this because it provides a direct path to compromise the underlying operating system. Exploitation requires authenticated access to the vulnerable application.
- No public exploit code.
- Vendor advisory exists.
- KEV status is unknown.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching or upgrading vm2 to version 3.11.1 for any application running untrusted code within a NodeVM with nesting enabled. If immediate patching is not feasible, isolate affected services to prevent arbitrary OS command execution and potential host compromise.
- Upgrade vm2 to 3.11.1.
- Isolate services if patching is delayed.
- Monitor for suspicious command execution.
