Summary
vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages.
When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package name with a non-exact match. For example, if the allowlist only permits left-pad, an attacker can still bypass the check with a colliding package name such as evil-left-pad, because it contains the allowlisted name.
If the colliding package already exists in a host path resolvable by the custom resolver, or if the target application's custom resolver / dependency-management workflow downloads the package and places it in a resolvable path, vm2 loads and executes that package in the host context. This lets sandboxed code bypass the module allowlist and may further lead to host code execution.
Details
NodeVM supports require.external to configure which external npm packages sandboxed code may load. It also supports a custom resolver through require.resolve. This combination is commonly used in business plugin systems, user-script platforms, or sandbox execution environments: the application allows only a small set of trusted dependencies while using a custom resolver that points to the application's own package directory.
The vulnerability is in the allowlist pre-check logic before the custom resolver is called. vm2 generates a regular expression from the external allowlist and uses it to check the original package name supplied by sandboxed code. However, the regular expression is not anchored to the full package-name boundary, so it performs a substring match on the original package name.
For example, with the following configuration:
new NodeVM({
require: {
external: ['left-pad'],
resolve: id => require.resolve(id, { paths: [customRoot] }),
context: 'host',
builtin: []
}
})The intended policy is that sandboxed code can only load left-pad. However, because vm2 uses a non-exact match similar to /left\-pad/ for the requested package name, names such as evil-left-pad and left-pad-backdoor also pass the allowlist pre-check.
After evil-left-pad passes the check, vm2 calls the custom resolver configured by the application. If the resolver can find that colliding package in a host-resolvable path, vm2 adds the returned path to the loadable list and, in context: 'host' mode, loads the package with the host require(). At that point, the package's top-level code executes in the host context instead of being constrained by sandbox restrictions such as NodeVM's builtin: [].
In local verification, the PoC only allows external: ['left-pad'] and sets builtin: [], so sandboxed code cannot directly load child_process. However, after the sandboxed code executes require('evil-left-pad'), vm2 still loads the colliding package from a host path. The colliding package's top-level code successfully invokes the host child_process module and prints HOST_EXEC.
This issue does not mean that vm2 automatically downloads malicious packages from npm at runtime. The attack requires the colliding package to already be in a path resolvable by the custom resolver, or for the target application's own dependency resolution / download workflow to place that package in such a path. This precondition limits the affected scenarios, but it does not change the core vulnerability: the external allowlist is not enforced against complete package-name boundaries, allowing sandboxed code to load a host package that the application did not authorize.
PoC
An independent PoC is attached in the poc directory. The PoC installs vm2 3.11.5, creates a temporary host package directory, and writes an unauthorized evil-left-pad package into it.
Run the following from the poc directory:
When the vulnerability is present, the output is similar to:
[+] vm2 version: 3.11.5
[+] customRoot: /tmp/vm2-resolver-poc-xxxxxx/custom
[+] Direct sandbox require("child_process") is blocked: ENOTFOUND
[+] Unrelated package is blocked: ENOTFOUND
[+] require("evil-left-pad") result: HOST_EXEC
[+] RESULT: VULNERABLE
HOST_EXEC is produced by the top-level code of the evil-left-pad package through host-side child_process.execFileSync(), demonstrating that the unauthorized package has executed in the host context.
Expected result: when the external allowlist only contains left-pad, evil-left-pad should be rejected.
Actual result: evil-left-pad passes the check because it contains the left-pad substring and then executes in the host context.
Impact
Under the affected configuration, an attacker can load a colliding host package that is not allowed by the external allowlist through sandboxed code, breaking NodeVM's module access control.
If the attacker can control or influence the contents of the colliding package, for example by placing a malicious package through a plugin upload directory, a user-controllable dependency directory, a private registry synchronization directory, an application-specific dependency download workflow, or another path reachable by the resolver, the attacker can further execute code in the host Node.js process context. The attacker may read files, environment variables, and secrets accessible to the host process, modify host-writable data, or interrupt the host service.
The main exploitation prerequisites are:
- The application uses vm2
NodeVM to execute untrusted or low-trust JavaScript code.
- The application enables a
require.external allowlist instead of allowing all external packages.
- The application configures a custom
require.resolve.
- The colliding package already exists in a path resolvable by that custom resolver, or the application's workflow downloads / synchronizes it into that path.
- The application loads external packages in the host context, or keeps the relevant default behavior.
If the deployed custom resolver only searches a fixed dependency directory that is fully trusted and cannot be influenced by an attacker, practical exploitability is reduced. However, in scenarios such as plugin systems, user scripts, uploadable dependency packages, private package-source synchronization, or multi-tenant sandbox platforms, this vulnerability can bypass the sandbox boundary.
Score
CVSS v4.0: 9.0 Critical
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- AV:N: The attack usually comes from remotely submitted sandboxed code, plugin code, or user scripts.
- AC:L: Once the affected configuration and package-reachability conditions are met, triggering the vulnerability requires only one
require() call.
- AT:P: The additional precondition is the presence of a custom resolver and a resolvable colliding package.
- PR:L: The attacker must be able to run code inside the sandbox.
- UI:N: No user interaction is required.
- VC:H / VI:H / VA:H: The vulnerability breaks vm2's module access control.
- SC:H / SI:H / SA:H: The PoC proves that an unauthorized package can execute in the host context, thereby affecting the host process / host system.
CWE: CWE-863 (Incorrect Authorization), CWE-706 (Use of Incorrectly-Resolved Name or Reference), CWE-829 (Inclusion of Functionality from Untrusted Control Sphere)
Credit
This vulnerability was discovered by:
CVE and credits are preferred.
If you have any questions regarding the vulnerability details, please feel free to reach out to us for further discussion. Our email address is xlabai@tencent.com.
Note
Note that we follow the security industry standard disclosure policy-the 90+30 policy (reference: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html). If the aforementioned vulnerabilities cannot be fixed within 90 days of submission, we reserve the right to publicly disclose all information about the issues after this timeframe.
XlabAITeam Reporter
keenanwgn Reporter
liangjs Reporter
Summary
vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages.
When
NodeVMenables anexternalallowlist together with a customresolvecallback, vm2 checks the requested package name with a non-exact match. For example, if the allowlist only permitsleft-pad, an attacker can still bypass the check with a colliding package name such asevil-left-pad, because it contains the allowlisted name.If the colliding package already exists in a host path resolvable by the custom resolver, or if the target application's custom resolver / dependency-management workflow downloads the package and places it in a resolvable path, vm2 loads and executes that package in the host context. This lets sandboxed code bypass the module allowlist and may further lead to host code execution.
Details
NodeVMsupportsrequire.externalto configure which external npm packages sandboxed code may load. It also supports a custom resolver throughrequire.resolve. This combination is commonly used in business plugin systems, user-script platforms, or sandbox execution environments: the application allows only a small set of trusted dependencies while using a custom resolver that points to the application's own package directory.The vulnerability is in the allowlist pre-check logic before the custom resolver is called. vm2 generates a regular expression from the
externalallowlist and uses it to check the original package name supplied by sandboxed code. However, the regular expression is not anchored to the full package-name boundary, so it performs a substring match on the original package name.For example, with the following configuration:
The intended policy is that sandboxed code can only load
left-pad. However, because vm2 uses a non-exact match similar to/left\-pad/for the requested package name, names such asevil-left-padandleft-pad-backdooralso pass the allowlist pre-check.After
evil-left-padpasses the check, vm2 calls the custom resolver configured by the application. If the resolver can find that colliding package in a host-resolvable path, vm2 adds the returned path to the loadable list and, incontext: 'host'mode, loads the package with the hostrequire(). At that point, the package's top-level code executes in the host context instead of being constrained by sandbox restrictions such asNodeVM'sbuiltin: [].In local verification, the PoC only allows
external: ['left-pad']and setsbuiltin: [], so sandboxed code cannot directly loadchild_process. However, after the sandboxed code executesrequire('evil-left-pad'), vm2 still loads the colliding package from a host path. The colliding package's top-level code successfully invokes the hostchild_processmodule and printsHOST_EXEC.This issue does not mean that vm2 automatically downloads malicious packages from npm at runtime. The attack requires the colliding package to already be in a path resolvable by the custom resolver, or for the target application's own dependency resolution / download workflow to place that package in such a path. This precondition limits the affected scenarios, but it does not change the core vulnerability: the
externalallowlist is not enforced against complete package-name boundaries, allowing sandboxed code to load a host package that the application did not authorize.PoC
An independent PoC is attached in the
pocdirectory. The PoC installs vm23.11.5, creates a temporary host package directory, and writes an unauthorizedevil-left-padpackage into it.Run the following from the
pocdirectory:When the vulnerability is present, the output is similar to:
HOST_EXECis produced by the top-level code of theevil-left-padpackage through host-sidechild_process.execFileSync(), demonstrating that the unauthorized package has executed in the host context.Expected result: when the
externalallowlist only containsleft-pad,evil-left-padshould be rejected.Actual result:
evil-left-padpasses the check because it contains theleft-padsubstring and then executes in the host context.Impact
Under the affected configuration, an attacker can load a colliding host package that is not allowed by the
externalallowlist through sandboxed code, breakingNodeVM's module access control.If the attacker can control or influence the contents of the colliding package, for example by placing a malicious package through a plugin upload directory, a user-controllable dependency directory, a private registry synchronization directory, an application-specific dependency download workflow, or another path reachable by the resolver, the attacker can further execute code in the host Node.js process context. The attacker may read files, environment variables, and secrets accessible to the host process, modify host-writable data, or interrupt the host service.
The main exploitation prerequisites are:
NodeVMto execute untrusted or low-trust JavaScript code.require.externalallowlist instead of allowing all external packages.require.resolve.If the deployed custom resolver only searches a fixed dependency directory that is fully trusted and cannot be influenced by an attacker, practical exploitability is reduced. However, in scenarios such as plugin systems, user scripts, uploadable dependency packages, private package-source synchronization, or multi-tenant sandbox platforms, this vulnerability can bypass the sandbox boundary.
Score
CVSS v4.0: 9.0 Critical
Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:Hrequire()call.CWE: CWE-863 (Incorrect Authorization), CWE-706 (Use of Incorrectly-Resolved Name or Reference), CWE-829 (Inclusion of Functionality from Untrusted Control Sphere)
Credit
This vulnerability was discovered by:
CVE and credits are preferred.
If you have any questions regarding the vulnerability details, please feel free to reach out to us for further discussion. Our email address is xlabai@tencent.com.
Note
Note that we follow the security industry standard disclosure policy-the 90+30 policy (reference: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html). If the aforementioned vulnerabilities cannot be fixed within 90 days of submission, we reserve the right to publicly disclose all information about the issues after this timeframe.