CyberRota Analysis
AI-GeneratedThe vm2 CLI tool prior to version 3.11.7 is vulnerable to a sandbox escape that enables attackers to execute arbitrary code within the host Node.js process. By supplying a crafted script that utilizes require(__filename), an attacker can bypass sandbox isolation and gain access to sensitive host modules, such as fs and child_process. Organizations using vm2 should prioritize patching to mitigate the risk of unauthorized code execution and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.