REDHAT-BUG-2477198: High severity vm2 vm2 vulnerability
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477198?
The severity of REDHAT-BUG-2477198 is rated high with a score of 7.
How do I fix REDHAT-BUG-2477198?
To fix REDHAT-BUG-2477198, upgrade to version 3.11.1 or later of the vm2 package.
What are the consequences of exploiting REDHAT-BUG-2477198?
Exploiting REDHAT-BUG-2477198 allows sandboxed code to unconditionally require the vm2 module, potentially compromising the outer VM's security.
Is REDHAT-BUG-2477198 present in all versions of vm2?
REDHAT-BUG-2477198 is present in all versions of vm2 prior to 3.11.1.
What is vm2 in the context of REDHAT-BUG-2477198?
vm2 is an open source virtual machine and sandbox for Node.js that is affected by the vulnerability in REDHAT-BUG-2477198.