Critical vm2 Sandbox Escape Enables RCE
💡AI-generated code needs isolation—this vm2 escape can turn a sandbox into host-level RCE.
⚡ 30-Second TL;DR
What Changed
vm2 3.11.6 and earlier are directly exploitable when require.external is enabled.
Why It Matters
AI coding agents, plugin systems, CI runners, and coding playgrounds that execute untrusted or AI-generated JavaScript may be exposed if they rely on vulnerable vm2 configurations. A successful escape could give attacker-controlled code access to the host application and system.
What To Do Next
Upgrade every vm2 deployment to 3.11.7 immediately, then audit NodeVM settings to disable unnecessary require.external access and narrowly scope require.root.
Key Points
- •vm2 3.11.6 and earlier are directly exploitable when require.external is enabled.
- •The vulnerable configuration is based on settings shown in vm2's own Quick Examples README.
- •vm2 3.11.7 blocks the specific attack, but overly broad require.root settings can remain dangerous.
- •Users should restrict require.root, set context: 'sandbox', and avoid vm2 for highly untrusted code when possible.
🧠 Deep Insight
Background and context from public sources — not the original article. 11 sources cited.
🔑 Enhanced Key Takeaways
- •The vm2 library was officially deprecated in July 2023 due to persistent security flaws before being resurrected in late 2025 with a commitment to a TypeScript rewrite.
- •Despite over 20 documented sandbox breakouts, vm2 remains a critical supply chain risk, maintaining over one million weekly downloads and serving as a dependency for nearly 900 NPM packages.
- •Recent 2026 vulnerabilities have specifically targeted WebAssembly (WASM) integration, utilizing JSPI and JSTag exception handling to bypass sandbox protections.
- •The recurring root cause of these escapes involves the library's inability to fully sanitize complex JavaScript objects, specifically Promises and Error.cause mechanisms, which allow attackers to reach host-level objects.
- •Security researchers now explicitly advise against using vm2 for untrusted code, recommending process-level isolation technologies like gVisor or Firecracker instead.
🛠️ Technical Deep Dive
- Vulnerabilities often exploit the failure to sanitize Error.cause and Promise callbacks, allowing prototype pollution that leads to host object access.
- Recent exploits leverage WebAssembly integration points, specifically targeting JavaScript Promise Integration (JSPI) and JSTag exception handling mechanisms.
- The sandbox relies on proxying and object wrapping, which fails when attackers manipulate host-level prototypes or utilize language features that bypass the proxy layer.
- The library's architecture is fundamentally challenged by the evolving nature of the JavaScript runtime, making it difficult to maintain a secure boundary without native-level isolation.
🔮 Future ImplicationsAI analysis grounded in cited sources
⏳ Timeline
📎 Sources (11)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: GitLab Blog ↗
This is a summary, not the original. Read the source, or get the weekly briefing.
Weekly AI briefing
One email a week. Unsubscribe anytime.