A critical flaw (CVSS 9.9) in vm2 3.11.3 through 3.11.6 lets sandboxed code reach Node.js's node:sqlite builtin and load a native library into the host process, escaping the sandbox entirely.
What Is It
vm2 exposes Node.js's host node:sqlite module to code running in NodeVM whenever that builtin is permitted; either named explicitly or swept in via builtin: ['*']. The module is wrapped with vm.readonly(), which blocks property assignment but leaves host-authority callables reachable. That wrapper is the failure point: readonly protection is treated as sufficient isolation for a module that hands out native-loading capability.
A secondary resolver quirk gives the same permitted module a second spelling. The resolver treats any request beginning with node: as a core-module request while the runtime strips only a single node: prefix, so a sandbox request for node:node:sqlite resolves to the configured node:sqlite entry. This is an aliasing inconsistency, not an allowlist bypass; it reaches the module only when node:sqlite is already permitted, and grants no access that a plain node:sqlite request would not.
From there, sandboxed code creates an in-memory DatabaseSync with extension loading enabled and calls DatabaseSync.loadExtension() against a native library bundled in the untrusted plugin package, with the path derived from __dirname. SQLite loads that library into the Node.js host process and invokes its native entry point. The result is arbitrary native code execution outside the sandbox, running with the host process's privileges.
The issue is classified as CWE-693 (Protection Mechanism Failure).
Why It Matters
The CVSS 3.1 base score is 9.9 (Critical), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The CVSS 4.0 score is 9.4 (Critical), with high impact on both the vulnerable system and subsequent systems.
vm2 is used to isolate untrusted code; a full escape to native execution at host privilege defeats the entire purpose of the control. The listed attack path is a plugin package that ships its own native library, which matches how vm2 is commonly deployed for third-party plugin execution.
No CISA KEV entry was supplied for this issue, so there is no confirmation of active exploitation in the provided source material. Readers tracking this by identifier should pull the CVE and advisory IDs directly from the vendor advisories linked below rather than from secondary summaries.
What's Vulnerable
- Vendor: patriksimek
- Product: vm2 (
pkg:npm/vm2) - Affected: versions 3.11.3 up to, but not including, 3.11.7
- Unaffected: 3.11.7 and later
Exposure requires the node:sqlite builtin to be permitted to the NodeVM, explicitly or through a builtin: ['*'] wildcard. Configurations that do not permit node:sqlite are not reachable by this attack path.
Patch Status
Fixed in vm2 3.11.7. Upgrade to 3.11.7 or later. As an interim mitigation, remove node:sqlite from the permitted builtin list and replace any builtin: ['*'] wildcard with an explicit allowlist. No KEV-mandated remediation deadline was supplied.