REDHAT-BUG-2477206: High severity npm/vm2 vulnerability
vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Because path validation uses path.resolve() (which does not dereference symlinks) but module loading uses Node's native require() (which does), an attacker can load arbitrary host-realm modules and achieve remote code execution. This vulnerability is fixed in 3.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2/NodeVMto a version that resolves this vulnerability.Fixed in 3.11.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477206?
The severity of REDHAT-BUG-2477206 is rated as high with a score of 7.
What vulnerability does REDHAT-BUG-2477206 describe?
REDHAT-BUG-2477206 describes a vulnerability in vm2 that allows path restriction bypass using filesystem symlinks.
How can I mitigate the effects of REDHAT-BUG-2477206?
To mitigate REDHAT-BUG-2477206, avoid using filesystem symlinks in NodeVM's require.root path.
Which versions of vm2 are affected by REDHAT-BUG-2477206?
REDHAT-BUG-2477206 affects vm2 version 3.10.5.
Is an update available for REDHAT-BUG-2477206?
An update to address REDHAT-BUG-2477206 should be created in a future release following its publication.