Critical remote code execution in vm2, a widely used Node.js sandbox library

This post details a critical sandbox escape vulnerability (CVSS 3.1: 10.0) discovered by GitLab's Threat Research Group in the vm2 Node.js sandboxing library. The vulnerability, found using AI automated tools, stems from default configurations in vm2's README that allow for remote code execution. While GitLab does not use vm2, the research highlights the risks associated with insecure sandboxing configurations, particularly the `require.external` and `require.root` settings. The post explains the technical details of the vulnerability, the limitations of the fix provided in vm2 Version 3.11.7, and provides recommendations for users to harden their configurations and consider alternative isolation methods like containers or separate processes for untrusted code. It also touches upon the broader challenge of recurring sandbox escape bugs in vm2.