[SECURITY] Replace abandoned sandbox with a maintained alternative in serverless-appsync-python

[ulises-jeremias]

Overview

The vm2 package used by serverless-appsync-simulator is completely abandoned (archived on GitHub, no new releases since 2023) and contains multiple unfixed critical RCE sandbox escape vulnerabilities. There is no patch available — the only fix is to replace it with a maintained alternative.

This affects examples/serverless-appsync-python and examples/serverless-appsync-node-typescript.

---

Vulnerability Summary

CVE / Advisory	Severity	Description
GHSA-cchq-frgv-rjh5	Critical	Sandbox escape via Error object
GHSA-g644-9gfx-q986	Critical	Sandbox escape via import()
GHSA-mrgp-mrhc-5jl4	Critical	Sandbox escape via Proxy objects
GHSA-xj72-wvfv-76cr	Critical	Sandbox escape via Promise
GHSA-ch3r-j5x3-6q2m	Critical	Regex in sandbox crash

Open Dependabot alerts: 26 (18 critical, 3 high, 4 medium, 1 low)

Dependency chain:

serverless-appsync-simulator → @workpop/graphql-mocked-server or similar → vm2

---

Why this matters

vm2 was used to isolate AppSync resolver evaluation (running VTL templates or JavaScript resolvers in a sandbox). Running arbitrary code in a broken sandbox is a developer-machine risk: a malicious resolver template could escape to the host system.

Even in a local development context, this is a significant risk if examples are used in CI or team environments.

---

Proposed Investigation Lines

Option A: Upgrade serverless-appsync-simulator

Check if a newer version of serverless-appsync-simulator (or its fork amplify-appsync-simulator) has already dropped vm2:

npm info serverless-appsync-simulator versions
npm info amplify-appsync-simulator dependencies

The AWS Amplify team maintains @aws-amplify/amplify-appsync-simulator which may have migrated away from vm2. Evaluate if this can replace the current simulator.

Option B: Replace vm2 with isolated-vm

isolated-vm is a maintained, actively developed V8 Isolate sandbox. It requires native bindings but provides true isolation:

npm install isolated-vm

This would require patching the code that calls vm2 APIs — a non-trivial but bounded change.

Option C: Replace vm2 with vm (Node.js built-in) + restrictions

For a development-only simulator, Node's built-in vm module with careful context setup may be acceptable since the threat model is local development only (not production).

Option D: Remove the local simulator and require a live AppSync endpoint

Some teams prefer running against a real AppSync endpoint in a dev account rather than simulating locally. This eliminates the sandboxing risk entirely.

---

Validation

cd examples/serverless-appsync-node-typescript
npm audit | grep vm2        # should return 0 results after fix
npm run start               # local simulator should still work

---

References

• vm2 GitHub repository (archived)
• vm2 npm security advisories
• isolated-vm — maintained V8 sandbox
• @aws-amplify/amplify-appsync-simulator
• Dependabot alert #971 (representative example)