A flaw was found in vm2. Untrusted guest code can exploit this vulnerability when the `crypto` builtin is explicitly allowlisted for a NodeVM (Node.js Virtual Machine). By calling the `crypto.setFips()` function, an attacker can modify the FIPS (Federal Information Processing Standards) mode of the entire host process. This allows guest code to bypass the NodeVM isolation boundary, leading to a sandbox escape and potentially impacting the integrity of the host system.
Fix evidence last checked: 2026-10-13 12:43 UTC