CVE-2026-100721

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM. The sanitizer leaves crypto.setFips callable, allowing guest code to change the FIPS mode of the entire host process, crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.

vm2, a sandbox for running untrusted JavaScript, in versions up to and including 3.11.3 uses prototype-walking index assignment in defaultSandboxPrepareStackTrace, allowing sandbox code to intercept error stack lines. The impact is low (information side channel) and the issue is fixed in version 3.11.4.

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omits nodejs.stream.disturbed and nodejs.stream.errored, which are exposed on host WebStream prototypes on newer Node.js releases. When the embedder exposes a host WebStream object and the host stream/web module to the sandbox, sandbox code can obtain the real host symbols and use them as write keys on host stream objects, corrupting host-visible stream state. This can bypass host logic that relies on Node's public stream-state helpers. It is not a host code-execution primitive in the reported proof of vulnerability. This is an incomplete fix for the earlier nodejs.* symbol filtering issue. Fixed in vm2 3.11.7.

A vulnerability in the vm2 CLI tool (before 3.11.7) allows sandbox escape and arbitrary code execution in the host Node.js process. Attackers can supply a malicious script that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError and then read the error's .stack property, bypassing the sandbox-side host-path redaction. Default new VM() and new NodeVM() configurations are affected without any special options.

A vulnerability in the vm2 library (npm) versions up to 3.12.0 allows sandbox escape in VM and NodeVM. When an embedder exposes a host API returning a host-realm Promise, the rejection sanitizer does not cover all cases, and sandboxed code can overwrite Promise properties to obtain an unsanitized host object. This can lead to arbitrary code execution on the host. Fixed in 3.12.1.

A vulnerability in NodeVM of vm2 before 3.12.1 allows sandbox escape because the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

A vulnerability in vm2 through 3.12.0 (fixed in 3.12.1) involves incorrect handling of a nullish `this` receiver in the apply trap of its bridge. When sandboxed code calls a host-provided non-strict function without a receiver, the undefined receiver is passed through, and V8 substitutes the host realm's global object. vm2 returns that object to the sandbox, allowing a complete sandbox escape and access to process. Exploitation requires the embedding application to expose at least one non-strict host function.

In vm2 before 3.11.6, the builtin: ['*'] configuration does not restrict access to os and dns builtins, allowing sandbox code to read host process identity and network topology. Attackers can use dns.setServers() to hijack the host process's DNS resolver globally.