REDHAT-BUG-2477196: High severity vm2 vm2 vulnerability
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '' wildcard). The module builtin exposes Node's Module.load(), which loads any module by name directly in the host context, completely bypassing vm2's builtin restriction. This allows sandboxed code to load excluded builtins like childprocess and achieve remote code execution. This vulnerability is fixed in 3.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477196?
The severity of REDHAT-BUG-2477196 is high, rated at 7.
What does REDHAT-BUG-2477196 affect?
REDHAT-BUG-2477196 affects the vm2 library, specifically versions prior to 3.11.0.
How can I fix REDHAT-BUG-2477196?
To fix REDHAT-BUG-2477196, upgrade vm2 to version 3.11.0 or later.
What type of vulnerability is REDHAT-BUG-2477196?
REDHAT-BUG-2477196 is a vulnerability that allows bypassing NodeVM's builtin allowlist.
What is the impact of REDHAT-BUG-2477196?
The impact of REDHAT-BUG-2477196 is that it potentially exposes the host context to arbitrary module loading through Node's Module._load().