{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nodevm/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NodeVM"],"_cs_severities":["critical"],"_cs_tags":["vm2","nodejs","sandbox-escape","supply-chain"],"_cs_type":"threat","_cs_vendors":["vm2"],"content_html":"\u003cp\u003eThe NodeVM component within the vm2 sandbox library contains a critical flaw where the 'os' and 'dns' built-in modules are not correctly identified as dangerous when using the 'builtin: ['*']' configuration. While prior security updates (GHSA-9g8x-92q2-p28f) restricted modules like 'diagnostics_channel' and 'perf_hooks' to prevent host-process state exposure, 'os' and 'dns' were omitted. Because NodeVM relies on a 'vm.readonly()' proxy, these modules expose host-process state that cannot be localized to the sandbox. Attackers can leverage 'os' to fingerprint the host environment (UID, GID, network interfaces) and 'dns.setServers()' to hijack DNS lookups for the entire host process. This allows for sophisticated supply-chain attacks, credential exfiltration, and service authentication subversion, effectively granting the sandboxed code control over the host's communication and configuration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an application leveraging vm2 with the 'builtin: ['*']' configuration.\u003c/li\u003e\n\u003cli\u003eThe attacker injects malicious JavaScript into the sandboxed environment.\u003c/li\u003e\n\u003cli\u003eThe attacker calls 'os.userInfo()' or 'os.networkInterfaces()' to perform host environment reconnaissance.\u003c/li\u003e\n\u003cli\u003eThe attacker invokes 'dns.setServers()' to point the host process's DNS resolution to an attacker-controlled resolver.\u003c/li\u003e\n\u003cli\u003eThe host process performs legitimate outbound requests (e.g., npm dependency installation, API calls, OIDC authentication).\u003c/li\u003e\n\u003cli\u003eThe attacker's DNS resolver intercepts these queries and returns malicious IPs.\u003c/li\u003e\n\u003cli\u003eThe host process connects to the attacker's infrastructure, facilitating data exfiltration, dependency substitution, or authentication bypass.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full compromise of the host process's network communication, enabling credential theft, supply-chain attacks via malicious package substitution, and bypass of host-side security controls. This vulnerability affects any Node.js application utilizing vm2 for untrusted code execution, including webhooks and CI/CD runners, potentially impacting production environments hosting multiple tenants.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize upgrading vm2 or modifying the 'builtin' allowlist immediately.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all vm2 configurations to identify instances using 'builtin: ['*']' and ensure '-os' and '-dns' are explicitly added to the exclusion list.\u003c/li\u003e\n\u003cli\u003eImplement the following Sigma rule to detect attempts to invoke sensitive 'os' or 'dns' methods within a sandboxed environment if logs are instrumented.\u003c/li\u003e\n\u003cli\u003eMonitor host process DNS configurations or anomalies in outbound HTTP request patterns for hosts running untrusted code.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T18:45:33Z","date_published":"2026-08-17T18:45:33Z","id":"https://feed.craftedsignal.io/briefs/2026-08-vm2-nodevm-escape/","summary":"The vm2 sandbox library fails to restrict the 'os' and 'dns' built-in modules when using the 'builtin: ['*']' configuration, enabling host-level information disclosure and process-wide DNS hijacking.","title":"NodeVM Sandbox Escape via Unrestricted OS and DNS Built-ins","url":"https://feed.craftedsignal.io/briefs/2026-08-vm2-nodevm-escape/"}],"language":"en","title":"CraftedSignal Threat Feed - NodeVM","version":"https://jsonfeed.org/version/1.1"}