Improper Control of Dynamically-Managed Code Resources in vm2 - #VU146045
Published: August 28, 2026
Vulnerability identifier: #VU146045
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-913
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the host system.
The vulnerability exists due to improper control of dynamically-managed code resources in NodeVM when accessing host prototype getters through console._stdout or console._stderr and overwriting EventEmitter.prototype.emit. A remote attacker can run crafted code inside the sandbox to execute arbitrary code on the host system.
This issue affects NodeVM instances with console inheritance enabled, which is the default configuration, and can bypass disallow-code-generation-from-strings restrictions.
Affected software
vm2
Remediation
Install security update from vendor's website.
vm2 - update to 3.11.8