CVE-2026-92940

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h85j-hv3c-qfgq. This link is maintained to preserve external references.

Original Description

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.

Summary

vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request options and the host TLS socket whenever an unrelated host HTTPS request releases a pooled connection.

In a contained test, sandbox code allowed only the https builtin:

• read the host request's bearer token from the agent event;
• attached a data listener to the released host TLS socket and read the next host response body in plaintext;
• learned the private service host and port;
• sent an attacker-chosen authenticated POST using the stolen host token; and
• received confirmation that the service accepted the action.

The host application never passed its credentials, request, response, socket, or destination into the sandbox. They crossed the boundary solely because vm2 exposes the process-global HTTPS agent instead of a sandbox-local network module instance.

Details

The vulnerable boundary is the default builtin loader in lib/builtin.js:

builtins.set(key, special ? special : vm => vm.readonly(hostRequire(key)));

The wrapper recursively exposes properties of the actual host module. For ordinary constants, a read-only proxy can be sufficient. It is not sufficient for process-global EventEmitter objects whose methods mutate internal state.

https.globalAgent is the default agent used by host HTTPS requests when the host does not supply a separate agent. The agent is shared by the entire Node.js thread. Its free event supplies both:

• the TLSSocket that has just completed a request and is available for reuse; and
• the connection/request options used to place that socket in the pool.

The following sandbox code registers directly on that host singleton:

const https = require('https');

https.globalAgent.on('free', (socket, options) => {
  const token = options.headers.Authorization;
  const destination = {host: options.host, port: options.port};

  socket.on('data', chunk => {
    capturedHostTraffic += chunk.toString('utf8');
  });

  const req = https.request({
    hostname: destination.host,
    port: destination.port,
    path: '/sandbox-action',
    method: 'POST',
    headers: {Authorization: token},
    agent: false,
  });
  req.end(attackerChosenBody);
});

Calling .on() is not a property assignment, so the read-only handler forwards it to the real host Agent. When the host later emits free, vm2 invokes the sandbox callback with bridged views of the live options and socket. Reading nested header values succeeds. Calling socket.on() also forwards to the real socket, letting the sandbox observe the decrypted bytes emitted during a later request on that connection.

The complete exploit flow is:

attacker-controlled NodeVM program with https allowed
  -> subscribe to the real host https.globalAgent
  -> unrelated host HTTPS request completes
  -> shared Agent emits live socket and request options into sandbox callback
  -> sandbox reads host Authorization token and private destination
  -> sandbox attaches to the released TLSSocket
  -> next host response is exposed in plaintext
  -> sandbox reuses stolen token for attacker-chosen authenticated request

This is a distinct residual of the same process-wide observability class for which other host builtins are rejected. The current dangerous-builtin filter does not classify https as process-global because the module also has legitimate sandbox network APIs. A safe implementation must avoid exposing the host singleton, such as by providing a sandbox-local module facade and sandbox-local Agent.

PoC

The attached PoC uses only a temporary certificate and a loopback HTTPS server.

1. Install Node.js and OpenSSL.

2. In the attached poc directory, run:

   npm install --ignore-scripts
   node…
   

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unrelated host HTTPS request releases a pooled connection, the listener receives the live host request options and the host TLSSocket, allowing sandboxed code to read the host's Authorization header and private destination host/port, attach a data listener to the released socket and read subsequent host response bodies in plaintext, and issue attacker-chosen authenticated requests using the stolen credentials. The issue is fixed in 3.11.7.