vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

What happened?

Summary On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require('node:node:test') and call run() with attacker-controlled execArgv. node:test.run() starts a separate Node process for process-isolated test execution and forwards the supplied execArgv values to that process. Supplying --eval= therefore executes arbitra

Key details

• Sandbox code can reach the host node:test module via require('node:node:test') due to prefix normalization.
• The readonly proxy does not restrict node:test.run() which accepts attacker-controlled execArgv for a spawned Node process.
• The root cause combines builtin admission, generic host passthrough, and prefix normalization treating test family as safe.
• Patched version 3.11.7 adds test to DANGEROUS_BUILTINS to reject both node:test and node:test/reporters.

Summarised by SecOraLens from GitHub Security Advisories. Always read the original source before acting. How SecOraLens verifies advisories.