TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

Node.js Sandboxing Security

1 post · Sep 2026

What this trail covers

GitLab's DevSecOps platform offers a suite of security testing tools including SAST, secret detection, DAST, dependency scanning, container scanning, license management, and code quality analysis. These tools integrate into CI/CD pipelines and provide inline feedback within merge requests, with consolidated reports available via security dashboards. Future enhancements include IAST, fuzzing, an auto-remediation feature, and an expanded vulnerability database. The platform is evolving to support more advanced security research and tooling, including the discovery and analysis of critical sandbox escape vulnerabilities in widely used libraries like vm2. This involves leveraging AI tools for vulnerability detection and providing detailed guidance on mitigation and best practices for sandboxing.

All GitLab trails
  1. Critical remote code execution in vm2, a widely used Node.js sandbox libraryThis post details the discovery and analysis of a critical sandbox escape vulnerability (CVSS 3.1: 10.0) in the vm2 Node.js sandboxing library. The vulnerability, found by GitLab's Threat Research Group using AI tools, stems from default configurations in the library's README that allow for remote code execution. While an update to version 3.11.7 addresses the specific attack vector, a broader configuration risk remains for users employing `require.external` with overly permissive `require.root` settings. The post provides a step-by-step breakdown of the vulnerability's mechanism, the limitations of the provided fix, and recommendations for users and tool builders.