GHSA-x6m4-chr9-cg97: Medium severity npm/vm2 vulnerability
Summary
Attacker-controlled code can trigger a host-realm syntax error and read its stack through the vm2 bridge. Host-realm stack formatting bypasses the sandbox-side redaction, so the returned value exposes absolute paths from vm2, Node.js internals, and the embedding application. Default VM and NodeVM configurations are affected without requiring special options.
PoC
A default-configured VM runs attacker-supplied code. Calling eval with deliberately malformed source makes the host-side source transformer throw a SyntaxError; reading .stack on the caught error exposes the host call stack to the sandbox.
js const { VM } = require("vm2"); console.log(new VM().run( var s; try { eval("@@@ catch") } catch (e) { s = e.stack } s; ));
Observed output
text SyntaxError: Unexpected character '@' at makeNiceSyntaxError (.../lib/transformer.js:41:16) at transformer (.../lib/transformer.js:116:8) at Object.transformAndCheck (.../lib/vm.js:76:14) at Object.apply (.../lib/setup-sandbox.js:2585:16) at VM.run (.../lib/vm.js:529:16)
The stack string returned to the sandbox contains absolute host paths for lib/transformer.js, lib/vm.js, lib/setup-sandbox.js, Node internals, and the embedding application's own source file.
Impact
Sandboxed code running under the default new VM() or new NodeVM() configuration can read absolute filesystem paths of the embedding application's source tree plus host function names, bypassing the host-path redaction added for GHSA-v27g-jcqj-v8rw. On a multi-tenant code-runner this discloses deployment layout such as /home/app/... or /var/task/..., useful for fingerprinting and for chaining into further attacks. The bridge forwards .stack reads to the host-realm formatter (lib/bridge.js:1482), so the sandbox-side stack redaction never runs; the leak does not require special configuration and persists when string eval is disabled, because the host-side transformer throws before eval is handled. Information disclosure only, no code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/vm2to a version that resolves this vulnerability.Fixed in 3.11.7
Event History
Frequently Asked Questions
Which deployments are affected?
Default VM and NodeVM configurations are affected. No special options are required.
What does an attacker need to exploit this issue?
The attacker needs to be able to run attacker-controlled code in a vm2 sandbox. They can invoke eval with deliberately malformed source and read the stack from the resulting caught SyntaxError.
What information can be exposed?
The sandbox can receive a host-realm stack trace containing absolute paths in vm2, Node.js internals, and the embedding application. The reported impact is information disclosure rather than integrity or availability impact.
How can I check whether a sandbox is vulnerable?
In a default-configured VM, run sandboxed code that catches an error from eval of malformed source and returns its stack. Exposure is indicated if the returned stack includes host-side frames or absolute paths such as vm2 lib/transformer.js, lib/vm.js, or lib/setup-sandbox.js.