CyberRota Analysis
AI-GeneratedThe vm2 sandbox for Node.js prior to version 3.11.6 contains a critical vulnerability that allows untrusted code to access sensitive host objects, such as the process object, through improperly sanitized error handling. This flaw can lead to arbitrary command execution within the host environment, posing significant security risks. Organizations utilizing vm2 for sandboxing should prioritize upgrading to version 3.11.6 or later to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then execute arbitrary host commands. This issue is fixed in version 3.11.6.