vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

Impact

Sandbox code can corrupt host-visible WebStream state checks for host WebStream objects that cross into the sandbox. In the validated PoV, a stream that the host has already consumed is made to appear undisturbed to stream.Readable.isDisturbed().

This can bypass host logic that relies on Node's public stream-state helpers to enforce one-shot body consumption, reject errored streams, or decide whether a host WebStream is safe to hand to another component.

This is not a host-code-execution primitive in the current PoV. The report is an incomplete-fix / guard-coverage gap in the same symbol-boundary family as the prior nodejs.* symbol advisory.

Affected Package/Versions

Confirmed affected on Node.js v25.8.0:

• v3.11.4
• v3.11.5
• current head 7a1f5100b96f48d34e0fe104ab37c0acc5944f92

v3.11.3 is also affected, but it predates the broader nodejs.* symbol fix. For this incomplete-fix report, the suggested affected range is >= 3.11.4, <= 3.11.5 on Node.js versions where these stream symbols exist.

No patched version is known.

Configuration Required

The PoV uses a VM where the embedder exposes a host WebStream object and the host stream/web module object to sandbox code:

const vm = new VM({ sandbox: { rs, streamWeb } });

This matches the same trust boundary as the earlier cross-realm symbol-write class: sandbox code must not be able to obtain registered Node.js internal symbols and write them back onto host objects.

The PoV is local-only. It does not require network access, a public target, NodeVM builtin access, process, filesystem access, or child-process access.

Local Proof of Concept

Run from the oss-zero-day-harness directory:

node submission-bundle/vm2-pov-test-incomplete-nodejs-stream-symbol-filter/pov-nodejs-stream-symbol-incomplete-fix.js

The PoV:

1. The host creates a ReadableStream.
2. The host reads one chunk so stream.Readable.isDisturbed(rs) is true.
3. Sandbox code confirms Symbol.for('nodejs.stream.disturbed') is blocked and returns a sandbox-local symbol.
4. Sandbox code extracts the real registered nodejs.stream.disturbed / nodejs.stream.errored symbols from the host ReadableStream.prototype.
5. Sandbox code writes an own nodejs.stream.disturbed property onto the host stream with value false.
6. The host calls stream.Readable.isDisturbed(rs) again and receives false.

Observed result on current head:

{
  "beforeHostDisturbed": true,
  "controls": {
    "symbolForDisturbedIsRegistered": false,
    "symbolForErroredIsRegistered": false
  },
  "extracted": [
    {
      "description": "nodejs.stream.disturbed",
      "keyFor": "nodejs.stream.disturbed"
    },
    {
      "description": "nodejs.stream.errored",
      "keyFor": "nodejs.stream.errored"
    }
  ],
  "overrideDisturbedOk": true,
  "afterHostDisturbed": false
}

Official Disclosure Policy Fit

vm2's SECURITY.md asks reporters not to create a public issue and to submit It asks for reproduction steps, affected versions, environment/configuration details, and potential impact:

• Policy: https://github.com/patriksimek/vm2/blob/main/SECURITY.md
• Private report route: https://github.com/patriksimek/vm2/security/advisories/new

This bundle is formatted for that private GitHub report flow and should not be posted publicly before maintainer triage and a fixed release.

Suggested Fix Direction

Make the dangerous-symbol checks namespace-based instead of list-based:

• In setup-sandbox.js, make isDangerousSymbol(sym) return true for any registered symbol whose Symbol.keyFor(sym) starts with nodejs..
• In bridge.js, make isDangerousCrossRealmSymbol(key) do the same for any symbol key crossing the bridge.
• In host-result scrubbing, delete all own symbol keys whose registered key starts with nodejs. instead of iterating a hard-coded list.
• Keep the current explicit list only as regression documentation, not as the complete security boundary.

Regression tests should include:

• Object.getOwnPropertySymbols(ReadableStream.prototype) must not expose nodejs.stream.disturbed or nodejs.stream.errored.
• A sandbox-local Symbol.for('nodejs.stream.disturbed') write must not affect host stream.Readable.isDisturbed().
• Even if the real symbol is passed into the sandbox by a host test harness, set, defineProperty, and deleteProperty traps must reject writes and deletes against host objects.

Why This Is Not Intended Behavior

The hardening comments and tests establish the intended invariant:

• any nodejs.* internal symbol should be sandbox-local when requested through Symbol.for();
• dangerous registered symbols should not be enumerable/extractable from host objects;
• even if a sandbox obtains one, bridge write traps should reject writes using that key.

This report shows that the source-side rule is active, but the extraction and write-trap rules are incomplete for newer registered nodejs.stream.* symbols.

Node's stream state helpers consult these symbols directly. For example, stream.Readable.isDisturbed() reads the internal disturbed symbol before falling back to public state. After sandbox writes an own property under the extracted symbol, the host helper returns attacker-controlled state.

Node's public documentation describes stream.isErrored(stream) as reporting whether a stream has encountered an error, and stream.Readable.isDisturbed(stream) as reporting whether the stream has been read from or cancelled:

• https://nodejs.org/api/stream.html#streamiserroredstream
• https://nodejs.org/api/stream.html#streamreadableisdisturbedstream