Skip to main content

Improper Control of Dynamically-Managed Code Resources


Severity High
Score 10/10


The NPM package `vm2` has a vulnerability in versions prior to 3.9.16 that can allow malicious actors to bypass `handleException()` to escape the sandbox which can then lead to Remote Code Execution (RCE) on the host running the sandbox. The flaw is in the way that the `transformer` function preprocesses code which allows an attacker to later bypass a `handleException()` which in its turn allows to raise a host exception. This can then be used to access the host "Function" constructor which allows to escape the sandbox and gain arbitrary code execution on the host.

  • LOW
  • HIGH
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-913 - Improper Control of Dynamically-Managed Code Resources

The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Advisory Timeline

  • Published