GHSA-m5w8-4gq2-6f8x

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

Published

2026-08-17

Modified

2026-08-17

Sources

github-advisory

Summary

# NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f) **CWE**: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) chained with CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-285 (Improper Authorization) — same class the maintainer codified as Defense Invariant #13 in `lib/builtin.js` and as Category 35 / GHSA-9g8x in `docs/ATTACKS.md`. **CVSS v3.1**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L` → 9.3 (Critical) (Scope = Changed because the data being read and the state being written both belong to the host process, not the sandbox. Confidentiality = High because `os.userInfo()` returns host UID/GID/username/homedir + `os.networkInterfaces()` returns the full host network topology including container/VM interfaces with IPs and MAC addresses. Integrity = High because `dns.setServers()` is a process-wide write that hijacks every subsequent DNS lookup the host makes — including outbound HTTP, telemetry, npm/registry, and any host code that uses `fetch` or URL-based fs paths. Privileges Required = None because the attacker controls sandbox code, which is the threat model `NodeVM` exists to mitigate.) ## Summary GHSA-9g8x-92q2-p28f closed the "process-wide observability builtins" class by adding `diagnostics_channel`, `async_hooks`, `perf_hooks`, and `v8` to `DANGEROUS_BUILTINS` in `lib/builtin.js`. The fix's rationale (in the commit message and `docs/ATTACKS.md` Category 35) is general: > Process-wide observability builtins. Unlike most Node builtins, these expose state of the *entire host process* rather than sandbox-local state — the vm2 boundary cannot usefully contain them because the data they surface […] belongs to the embedder. Even a readonly proxy that forwards every call to the host module is a working host-data exfiltration primitive. Two builtins satisfying the same description were not added: **`os`** and **`dns`**. Both are reachable today under the documented `builtin: ['*']` configuration; both expose host-process state that the `vm.readonly()` proxy cannot localise; and both have *write* APIs that mutate global host-process state from the sandbox (`os.setPriority()`, `dns.setServers()`, `dns.setDefaultResultOrder()`). `dns.setServers()` in particular turns sandbox code into a process-wide DNS hijack primitive — strictly worse than every read-only leak that GHSA-9g8x added. Adding `os` and `dns` to `DANGEROUS_BUILTINS` extends the same fix to the rest of the class. The existing `isDangerousBuiltin(key)` family-prefix matcher (added by GHSA-rp36-8xq3-r6c4) automatically catches `node:os`, `node:dns`, and `node:dns/promises` once the family names are present. ## Affected - vm2 `v3.11.5` (current `package.json` version on `main`) and the unreleased `[3.11.4]` slot that ships GHSA-9g8x-92q2-p28f, GHSA-rp36-8xq3-r6c4, GHSA-r9pm-gxmw-wv6p, et al. - All NodeVM configurations that expand the builtin allowlist via `'*'` (the documented "full builtins" pattern) and have not manually appended `-os`, `-dns` exclusions — which is the recommended config in README and the test fixtures. - Reproduced on Node v22.12.0 with HEAD `7a1f510` of the audit checkout. ## Vulnerability details ### [A] — Source: the `'*'` wildcard expansion includes `os` and `dns` `lib/builtin.js:166-167`: ```js const BUILTIN_MODULES = (nmod.builtinModules || Object.getOwnPropertyNames(process.binding('natives'))) .filter(s => !s.startsWith('internal/') && !s.startsWith('_') && !isDangerousBuiltin(s)); ``` `isDangerousBuiltin` resolves the current `DANGEROUS_BUILTINS` set (`lib/builtin.js:83-139`): ```js const DANGEROUS_BUILTINS = new Set([ 'module', 'worker_threads', 'cluster', 'vm', 'repl', 'inspector', 'process', 'trace_events', 'wasi', // GHSA-9g8x-92q2-p28f: 'diagnostics_channel', 'async_hooks', 'perf_hooks', 'v8' ]); ``` `os` and `dns` are absent. Under `builtin: ['*']` the

Affected packages

Remediation: Upgrade to 3.11.6 or later.

References

• https://github.com/advisories/GHSA-m5w8-4gq2-6f8x