CVE-2023-37466: Vm2_project Vm2 RCE Vulnerability

CVE-2023-37466 Overview

CVE-2023-37466 is a sandbox escape vulnerability in vm2, a JavaScript sandbox library for Node.js. The flaw affects vm2 versions up to and including 3.9.19. Attackers can bypass the Promise handler sanitization using the @@species accessor property to escape the sandbox and execute arbitrary code in the host context. The issue is classified as [CWE-94] Improper Control of Generation of Code (Code Injection). Version 3.10.0 contains the patch. The vm2 project has since been discontinued and should not be used in production environments.

Critical Impact
Successful exploitation allows remote code execution outside the vm2 sandbox, granting attackers full control of the host Node.js process.

Affected Products

vm2 versions up to and including 3.9.19
Node.js applications embedding vm2 for untrusted code execution
NetApp products bundling vulnerable vm2 releases (see NetApp Security Advisory ntap-20241108-0002)

Discovery Timeline

2023-07-14 - CVE-2023-37466 published to NVD
2026-01-05 - Last updated in NVD database

Technical Details for CVE-2023-37466

Vulnerability Analysis

The vm2 library wraps user-supplied JavaScript in proxies and frozen objects to prevent access to host-level globals. The sandbox relies on intercepting Promise resolution to keep callbacks executing inside the contextified VM. The sanitization layer for Promise handlers failed to account for the Symbol.species (@@species) accessor, which JavaScript uses to determine the constructor of derived Promise instances. Attackers can supply a Promise subclass that overrides @@species to return a constructor controlled outside the sandbox. When vm2 invokes Promise chaining methods such as then or catch, the engine instantiates the host-side constructor and invokes its executor with sandbox-supplied callbacks, executing those callbacks with host privileges.

Root Cause

The root cause is incomplete mediation in the bridge that proxies Promise objects between the sandbox and the host. The handler sanitization only validated the directly attached then, catch, and finally methods. It did not block lookups through Symbol.species on Promise subclasses, leaving a path to reach unwrapped host objects.

Attack Vector

Exploitation requires the ability to submit JavaScript to a vm2 instance. Any application that evaluates untrusted code, plugins, templates, or expressions in vm2 is exposed. Network reachability to such an evaluator is sufficient; no authentication or user interaction is required. Once executed, attacker code runs with the privileges of the Node.js process, enabling file system access, network pivoting, and credential theft.

javascript

// Patch excerpt from lib/bridge.js - adds isProxy short-circuit
// and removes accidental key-access escape paths.
const thisThrowOnKeyAccessHandler = thisObjectFreeze({
	__proto__: null,
	get(target, key, receiver) {
		if (key === 'isProxy') return true;
		if (typeof key === 'symbol') {
			key = thisReflectApply(thisSymbolToString, key, []);
		}
		throw new VMError(`Unexpected access to key '${key}'`);
	}
});

const emptyFrozenObject = thisObjectFreeze({
	__proto__: null
});

const thisThrowOnKeyAccess = new ThisProxy(emptyFrozenObject, thisThrowOnKeyAccessHandler);
// Source: https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744

A second patch in lib/setup-sandbox.js removes the local Promise binding so that sandbox code no longer receives a pre-wrapped Promise constructor that could be subclassed to abuse @@species. See the GitHub Commit Log for the full diff.

Detection Methods for CVE-2023-37466

Indicators of Compromise

Node.js processes spawning unexpected child processes such as /bin/sh, cmd.exe, or powershell.exe from application workers that host vm2.
Outbound network connections from Node.js services that previously communicated only over loopback or with internal APIs.
Application logs showing JavaScript inputs that reference Symbol.species, constructor[Symbol.species], or Promise subclasses immediately before instability or errors.

Detection Strategies

Inventory all Node.js services and identify any dependency tree containing vm2 at versions <= 3.9.19 using npm ls vm2 or software composition analysis tooling.
Hunt for sandbox-escape payload patterns in application telemetry, including request bodies containing Symbol.species, class extends Promise, or Reflect.getPrototypeOf against Promise objects.
Correlate Node.js parent processes with file system writes outside the application working directory.

Monitoring Recommendations

Enable process-tree auditing for Node.js services and alert on shell invocations originating from worker processes.
Forward application stdout, stderr, and uncaught exception logs to a centralized analytics pipeline for retrospective hunting.
Track egress connections from sandbox host services and baseline expected destinations.

How to Mitigate CVE-2023-37466

Immediate Actions Required

Upgrade vm2 to version 3.10.0 or later in every application dependency tree.
Because the vm2 project is discontinued, plan migration to an actively maintained isolation mechanism such as isolated-vm, Node.js vm with worker threads, or container-based sandboxing.
Apply vendor patches for downstream products that bundle vm2, including those listed in the NetApp Security Advisory ntap-20241108-0002.

Patch Information

The fix is included in vm23.10.0. Patch details are published in the GitHub Security Advisory GHSA-cchq-frgv-rjh5 and the GitHub Release v3.10.0 notes.

Workarounds

Refuse untrusted JavaScript input until vm2 is upgraded or replaced.
Run Node.js services that evaluate untrusted code under least-privilege accounts with seccomp or AppArmor profiles that block process execution and outbound networking.
Place a strict allowlist or schema validator in front of any endpoint that forwards user input into a vm2 evaluator.

bash

# Verify and upgrade vm2 across a project
npm ls vm2
npm install vm2@^3.10.0 --save
npm audit --production