DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-2CM2-M3W5-GP2F: GHSA-2CM2-M3W5-GP2F: Remote Code Execution via Transformer Bypass in vm2

#security #cve #cybersecurity #ghsa

GHSA-2CM2-M3W5-GP2F: Remote Code Execution via Transformer Bypass in vm2

Vulnerability ID: GHSA-2CM2-M3W5-GP2F
CVSS Score: 10.0
Published: 2026-05-08

The vm2 package for Node.js provides a software-based sandbox for untrusted code execution. Vulnerability GHSA-2CM2-M3W5-GP2F enables an attacker to bypass these sandbox protections via the Transformer component. The issue resides in the parsing logic responsible for intercepting JavaScript property access. Attackers leverage custom prototypes and computed keys to expose the internal sandbox state mechanism, leading to full host compromise.

TL;DR

A critical sandbox escape vulnerability in the vm2 library allows attackers to execute arbitrary code on the host system. The flaw exists in the Transformer component, which fails to correctly secure computed-key access on objects with custom prototypes. Exploitation yields full unauthenticated Remote Code Execution.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-693: Protection Mechanism Failure
  • Attack Vector: Network / Untrusted Input
  • CVSS Score: 10.0 (Critical)
  • Impact: Unauthenticated Remote Code Execution (RCE)
  • Exploit Status: Proof of Concept Available
  • KEV Status: Not Listed

Affected Systems

  • Node.js applications processing untrusted JavaScript using vm2 versions < 3.11.2
  • Serverless platforms relying on vm2 for tenant isolation
  • Dynamic configuration systems evaluating user-provided scripts via vm2
  • vm2: < 3.11.2 (Fixed in: 3.11.2)

Mitigation Strategies

  • Upgrade vm2 package to version 3.11.2 immediately.
  • Migrate to a V8-isolate based sandbox alternative such as isolated-vm.
  • Implement WAF rules to detect the internal state variable string in payloads.
  • Run the Node.js process with minimal operating system privileges.

Remediation Steps:

  1. Identify all projects and transitive dependencies utilizing the vm2 package.
  2. Update package.json and run npm install to pull version 3.11.2.
  3. Deploy WAF signatures to block requests containing VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.
  4. Initiate an architectural review to replace vm2 with isolated-vm.

References

Read the full report for GHSA-2CM2-M3W5-GP2F on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)