Critical · published January 26, 2026
🚨 A sneaky oversight in vm2 prior to version 3.10.2 can let attackers slip out of the sandbox like a magician escaping a locked box! 🔥 Think of vm2 as a high-security restaurant kitchen. The proper ingredients (sandboxed code) are supposed to stay inside, but with this vulnerability, a crafty cook can sneak out and grab any item from the pantry (run arbitrary code) without anyone noticing! An attacker could potentially break out of the sandbox and execute arbitrary code on the server, turning your secure environment into a free-for-all. This could lead to unauthorized access to sensitive data, malicious modifications, and a wave of havoc in your application!
Think of vm2 as a high-security restaurant kitchen. The proper ingredients (sandboxed code) are supposed to stay inside, but with this vulnerability, a crafty cook can sneak out and grab any item from the pantry (run arbitrary code) without anyone noticing! This vulnerability arises because the sanitation of callbacks in `globalPromise.prototype.then` is missing, allowing attackers to bypass the protective measures put in place by the `localPromise.prototype.then` sanitization. As a result, the return value of async functions can access the global context.
An attacker could potentially break out of the sandbox and execute arbitrary code on the server, turning your secure environment into a free-for-all. This could lead to unauthorized access to sensitive data, malicious modifications, and a wave of havoc in your application! Upgrade vm2 to version 3.10.2 immediately to patch this flaw. Review your implementation to ensure proper sandboxing practices are followed, and consider adding additional validation measures on user inputs to bolster security. You've got this! Follow these steps, and your applications will be safer in no time! 🛡️