CyberRota Analysis
AI-GeneratedVersions of vm2 NodeVM prior to 3.12.1 are vulnerable to a critical sandbox escape due to an incomplete denylist that fails to block the child_process module. This oversight allows attackers to execute arbitrary commands on the host system when the NodeVM is configured to allow built-in modules, posing a severe risk to any applications using this configuration. Organizations utilizing vm2 NodeVM should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.