vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process. This issue has been patched in version 3.11.4.

Affected: npm: vm2

## Summary

`NodeVM` blocks several dangerous Node.js builtins such as `module`, `worker_threads`, `cluster`, `vm`, `repl`, and `inspector`.

However, the denylist misses `process` and `inspector/promises`. Both can be used from sandboxed code to reach host-side execution primitives.

This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process.

## Details

The dangerous builtin denylist is defined in `lib/builtin.js`. This list does not include:

```text process inspector/promises ```

Non-denied builtins are exposed to the sandbox through:

```js builtins.set(key, special ? special : vm => vm.readonly(hostRequire(key))); ```

Because of this, sandboxed code can bypass the expected restrictions in two ways:

1. `require('process').getBuiltinModule('child_process')` reloads `child_process`, even when `child_process` is excluded. 2. `require('inspector/promises')` exposes the Inspector protocol and can call `Runtime.evaluate` in the host process.

## PoC

Tested on:

```text vm2: 3.11.2 Node.js: v25.9.0 ```

Run from the vm2 repository root:

```bash node poc/dangerous-builtin-denylist-rce.js ``` [dangerous-builtin-denylist-rce.js](https://github.com/user-attachments/files/27570113/dangerous-builtin-denylist-rce.js)

The PoC first confirms the intended restrictions work:

```text require("inspector"): BLOCKED require("child_process"): BLOCKED ```

Then it bypasses them:

```text require("process").getBuiltinModule("child_proces…

shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators json-2-csv: json-2-csv: CSV Injection vulnerability allows arbitrary code execution via `preventCsvInjection` bypass. crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME net/mail: golang: Go net/mail: Denial of Service via crafted email inputs axios: Axios: HTTP Transport Hijacking via Prototype Pollution axios: Axios: Arbitrary HTTP header injection via prototype pollution axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling axios: Axios: NO_PROXY bypass via crafted URL axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input net/mail: golang: net/mail: Denial of Service via pathological email address parsing axios: Axios: Information disclosure of proxy credentials via HTTP redirects axios: Axios: Information disclosure of proxy credentials via redirect flows axios: Axios: Denial of Service due to unenforced request and response size limits axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution…

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.