Node.js Module vm2 < 3.10.2 Sandbox Breakout

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297233);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/18");

  script_cve_id("CVE-2026-22709");

  script_name(english:"Node.js Module vm2 < 3.10.2 Sandbox Breakout");

  script_set_attribute(attribute:"synopsis", value:
"A module in the Node.js JavaScript run-time environment is affected by a sandbox breakout vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the Node.js module vm2 installed on the remote host is prior to 3.10.2. It is, therefore affected by a
sandbox breakout vulnerability due to a flaw with the `Promise.prototype.then` and `Promise.prototype.catch` callback
sanitization. An unauthenticated, remote attacker can exploit this, to escape the sandbox and run arbitrary code.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2429923a");
  script_set_attribute(attribute:"solution", value:
"Upgrade to vm2 version 3.10.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-22709");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vm2_project:vm2");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'vm2');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'vm2');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'max_version': '3.10.0', 'fixed_version' : '3.10.2' }
];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);