GitHub Security Advisory

On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require('node:node:test') and call run() with attacker-controlled execArgv .

node:test.run() starts a separate Node process for process-isolated test execution and forwards the supplied execArgv values to that process. Supplying --eval= therefore executes arbitrary JavaScript in an unrestricted host Node process, outside the NodeVM sandbox.

The PoC confirms that direct sandbox imports of fs , child_process , module , and process remain denied before the spawned process imports host fs and writes a harmless marker.

Affected versions and environment

Affected versions: >=3.9.6, runs outside vm2 and has normal host builtin access.

The doubled prefix is the reachability mechanism, but the security boundary failure is broader: the generic host-passthrough loader treats the test builtin family as safe even though its run() API can launch unrestricted Node processes.

From the poc directory:

Expected successful result on Node.js 24+ includes:

The PoC writes only host-rce-marker.json in its own directory and does not invoke a shell, a network service, or access third-party data.

An attacker who is intentionally permitted to execute untrusted JavaScript in the affected NodeVM configuration can escape the sandbox and execute arbitrary JavaScript under the embedder's operating-system identity.

This provides the spawned process with the host user's filesystem, environment, network, and process-execution permissions. It can therefore result in complete confidentiality, integrity, and availability impact for the hosting service.

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — 9.9 Critical.

The explicit builtin configuration and Node.js 24+ runtime requirement should remain prominent, but they do not reduce the demonstrated impact after the affected sandbox is reachable. This is consistent with scoring sandbox-code submission as low privileges and the escape from sandbox authority to host authority as scope changed.

Suggested remediation

Treat the normalized test builtin family as dangerous before wildcard expansion and explicit builtin registration.

For example, add test to DANGEROUS_BUILTINS so the existing prefix and family checks reject both node:test and node:test/reporters :

If test helpers must be exposed, provide a sandbox-local wrapper through mock or override that does not expose run() , process isolation, execArgv , or other host process controls.

Recommended regression cases:

explicit builtin: ['node:test']

wildcard builtin configurations

require('node:node:test')

node:test/reporters and prefixed variants

direct low-level builtin registration

attempts to pass --eval , --require , or --import through test-runner process options vm2-node-test-ghsa-submission.zip