CVE-2023-37466 in vm2
Summary
by MITRE • 07/14/2023
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/06/2026
The vm2 library represents a sophisticated sandboxing mechanism designed for Node.js environments, enabling developers to execute untrusted code within isolated contexts. This security-critical vulnerability affects versions up to 3.9.19 where the Promise handler sanitization mechanism fails to properly validate the @species accessor property. The @species symbol is a well-defined ECMAScript feature that controls the constructor used by array methods and other built-in objects, but in this context it becomes a vector for privilege escalation. When an attacker crafts malicious code that leverages this accessor property, they can bypass the intended sandbox boundaries and gain access to the underlying Node.js environment.
The technical flaw stems from insufficient sanitization of Promise-related constructs within the vm2 sandbox implementation. Specifically, the @@species accessor property allows attackers to manipulate the constructor behavior of Promise objects and their derivatives, effectively circumventing the security controls designed to prevent code execution outside the designated sandbox boundaries. This vulnerability operates at the intersection of JavaScript's internal object handling mechanisms and sandbox security models, creating a path for attackers to escalate privileges from within the restricted execution environment. The exploitation requires understanding of JavaScript's internal symbol handling and the specific sandboxing implementation details within vm2.
The operational impact of this vulnerability extends beyond simple code execution, as it fundamentally compromises the security model that vm2 was designed to provide. Remote code execution within the context of the vm2 sandbox represents a severe threat to applications that rely on this library for executing untrusted code. Attackers can leverage this vulnerability to access sensitive system resources, perform unauthorized operations, and potentially escalate their privileges to the level of the host Node.js process. The discontinuation of project maintenance exacerbates the risk as no further patches or updates are available to address this vulnerability, leaving affected systems permanently exposed to exploitation attempts.
Organizations utilizing vm2 in production environments must immediately implement mitigations to address this critical vulnerability. The recommended approach involves upgrading to version 3.10.0 or later where the patch specifically addresses the @@species accessor property bypass. Additionally, administrators should conduct comprehensive security assessments of all systems using vm2 to identify potential exploitation vectors and implement network segmentation to limit the attack surface. Security monitoring should be enhanced to detect anomalous behavior patterns that may indicate exploitation attempts, particularly around Promise-related operations and constructor manipulations. The vulnerability demonstrates the critical importance of maintaining up-to-date security libraries and implementing robust security monitoring practices to prevent successful exploitation of sandbox bypass vulnerabilities.
This vulnerability aligns with CWE-242, which addresses the use of potentially dangerous functions, and reflects the broader category of sandbox escape techniques documented in ATT&CK framework under T1059.006 for execution through Node.js. The issue also relates to CWE-78, command injection vulnerabilities, as the sandbox escape enables arbitrary code execution. Organizations should consider implementing additional security controls such as process isolation, resource limiting, and code analysis tools to detect and prevent similar vulnerabilities in other sandboxing implementations. The discontinuation of vm2 maintenance highlights the critical need for organizations to evaluate the long-term sustainability and security posture of third-party libraries they depend upon, particularly those implementing security-critical components like sandboxing mechanisms.