SB2026082830 - Multiple vulnerabilities in vm2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082830

SB2026082830 - Multiple vulnerabilities in vm2

Published: August 28, 2026

Security Bulletin ID SB2026082830
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 67% Medium 17% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the NodeVM builtin loader for the host util and sys modules when handling sandboxed code that accesses util.getCallSites(). A remote attacker can execute sandboxed code that calls util.getCallSites() to disclose sensitive information.

Only configurations that allow the util or sys builtin, including wildcard builtin loading, are vulnerable. Node.js 22.9 or later is required, and the exposed data can include absolute file paths, function names, line numbers, and the embedding application\'s entrypoint.


2) Protection mechanism failure (CVE-ID: N/A)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the host system and disclose sensitive information.

The vulnerability exists due to a protection mechanism failure in handleException error sanitization for AggregateError in vm2 when processing a host-wrapped AggregateError that is revisited within a single exception-handling traversal. A remote attacker can trigger a crafted host exception through an exposed host function to execute arbitrary code on the host system and disclose sensitive information.

The issue occurs on the caught-exception throw channel and is limited to AggregateError-based cyclic or duplicate reference shapes such as self-cycles, mutual-cycles, or the same host aggregate referenced multiple times in errors[].


3) Prototype pollution (CVE-ID: N/A)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify host typed-array and ArrayBuffer prototype behavior, causing integrity and availability impacts.

The vulnerability exists due to improperly controlled modification of object prototype attributes in host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype when running untrusted JavaScript in a default vm2 VM. A remote attacker can execute sandboxed code that reaches and mutates host prototypes to modify host typed-array and ArrayBuffer prototype behavior, causing integrity and availability impacts.

The issue crosses the sandbox boundary and affects ordinary host-created typed arrays and ArrayBuffers after VM.run() returns.


4) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncaught exception handling in the vm2 promise bridge when calling a host function that returns a rejected host promise and ignoring the returned value. A remote attacker can execute sandboxed code that invokes a host promise-returning API without attaching a rejection handler to cause a denial of service.

Exploitation requires the ability to run code in a vm2 sandbox and an exposed host promise-returning API, or a NodeVM configuration that permits the events builtin.


5) Improper Control of Dynamically-Managed Code Resources (CVE-ID: N/A)

CWE-ID: CWE-913 - Improper Control of Dynamically-Managed Code Resources

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the host system.

The vulnerability exists due to improper control of dynamically-managed code resources in NodeVM when accessing host prototype getters through console._stdout or console._stderr and overwriting EventEmitter.prototype.emit. A remote attacker can run crafted code inside the sandbox to execute arbitrary code on the host system.

This issue affects NodeVM instances with console inheritance enabled, which is the default configuration, and can bypass disallow-code-generation-from-strings restrictions.


6) Protection mechanism failure (CVE-ID: N/A)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service and bypass configured asynchronous execution restrictions.

The vulnerability exists due to protection mechanism failure in Promise static method handling in VM and NodeVM when processing attacker-controlled thenables with allowAsync: false. A remote user can supply a specially crafted thenable to continue sandboxed code execution after run() returns and cause a denial of service and bypass configured asynchronous execution restrictions.

The issue affects Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled, and code execution can occur outside the configured timeout.


Remediation

Install update from vendor's website.

References