vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors.

• vm2 version: ~3.9.14
• Node version: 18.15.0, 19.8.1, 17.9.1

Impact

A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

Patches

This vulnerability was patched in the release of version 3.9.15 of vm2.

Workarounds

None.

References

Github Issue - #515
PoC - https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d

For more information

If you have any questions or comments about this advisory:

• Open an issue in VM2

Thanks to the research team in KAIST WSP Lab for disclosing this vulnerability.