| Package | Affected versions | Patched versions |
|---|---|---|
| vm2 | ≥ 3.11.3, < 3.11.7 | 3.11.7 |
Summary
vm2 3.11.6 exposes the host tls module to a NodeVM when that builtin is explicitly allowed. Although the module object is wrapped as read-only, its functions still execute against process-wide host state. On Node.js versions that provide tls.setDefaultCACertificates(), sandbox code can replace the certificate authorities trusted by subsequent host-realm TLS clients.
The exploit needs only the narrowly allowed tls and url builtins. It does not require fs, process, module, child_process, an external package, or a general '*' builtin grant. A host HTTPS request rejected an attacker certificate before sandbox execution, then accepted the same certificate and returned an application marker after the sandbox replaced the default CA list.
This crosses the intended sandbox boundary. An attacker can make host HTTPS clients trust an attacker-controlled CA, enabling credential theft and response tampering when the attacker can influence a subsequent destination or network path. Replacing the list also removes the normal trust roots, disrupting unrelated host TLS traffic.
The vulnerable boundary is the default builtin loader in lib/builtin.js. Builtins that are not classified as dangerous are exposed through a recursive read-only bridge:
builtins.set(key, special ? special : vm => vm.readonly(hostRequire(key)));
The read-only wrapper prevents ordinary property assignment through the sandbox proxy. It does not make calls such as tls.setDefaultCACertificates() sandbox-local. That function changes the default CA list for the current Node.js thread and affects subsequent TLS connections that do not provide their own ca option.
The dangerous-builtin list now rejects dns because dns.setServers() mutates process-wide host networking state. It does not reject tls, even though current Node.js exposes an equivalent process-wide trust mutation through it.
A direct call with a normal sandbox array is not necessary. The native TLS function requires an actual host-realm array. The allowed host url module provides one:
const tls = require('tls');
const {URLSearchParams} = require('url');
const hostArray = new URLSearchParams(
'ca=' + encodeURIComponent(attackerCaPem)
).getAll('ca');
tls.setDefaultCACertificates(hostArray);
URLSearchParams.getAll() executes in the host realm and returns a host array containing the attacker-controlled PEM string. vm2 maps that array into the sandbox. When the mapped value is passed back to the TLS function, the bridge unwraps it to the original host array, satisfying the native type check. The TLS function then replaces the host thread's default CA set.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThe complete exploit flow is:
attacker-controlled NodeVM program
-> require only the allowed tls and url builtins
-> URLSearchParams.getAll() creates a host array containing attacker CA PEM
-> bridge unwraps the mapped array when passed back to tls
-> tls.setDefaultCACertificates() replaces host default trust roots
-> subsequent host-realm HTTPS client accepts attacker-signed certificates
-> attacker can observe or modify application TLS traffic
The API is present in Node.js 22.19.0 and later in the 22.x line, and Node.js 24.5.0 and later in the 24.x line.
The attached PoC is fully local. It creates a temporary CA and a loopback HTTPS server signed by that CA, then performs two requests from the host realm.
Install Node.js 22.19.0 or later in the 22.x line, or Node.js 24.5.0 or later in the 24.x line. OpenSSL must also be available.
In the attached poc directory, run:
npm install --ignore-scripts
node poc.js
A vulnerable result has all of these properties:
VM2_POC_HOST_TLS_RESPONSE_3e71c8.The server listens only on loopback and the PoC makes no external request.
This is an improper sandbox authorization boundary around a process-wide TLS security setting.
An attacker who can submit code to a NodeVM configured with the tls and url builtins can:
The attacker does not obtain a direct file or command-execution primitive from this PoC. The critical impact is control of the host process's authentication trust decision, outside the sandbox's authority. Connections that explicitly provide their own CA list are not affected, and already cached TLS sessions may remain unchanged.