All 15 Core Node.js Modules questions
More in Core Node.js Modules
What does the node:zlib module provide, and how would you use it to compress an HTTP response? What does the node:util.types module provide, and how does it differ from JavaScript's built-in typeof operator? What does the node:readline module provide, and what is a common use case for it? What is the node:stream module's Transform stream, and how does it differ from a Readable or Writable stream? What does the node:perf_hooks module provide, and how would you use it to measure precise execution time of a code block?
Advertisement
Node.js › Core Node.js Modules

What is the node:vm module, and what are the security implications of using it to execute untrusted code?

Advanced

Answer

vm compiles and runs JavaScript within a separate V8 context, often for sandboxing -- but its isolation is not a genuine hardened security boundary, since code running inside can, through known techniques, escape into the surrounding process in certain configurations, so it shouldn't be the sole defense for truly untrusted code.
vm.createContext(context);
vm.runInContext('result = 2 + 2;', context);
Real-world example A low-code platform initially ran user formula scripts via vm alone, but moved to a separate resource-limited child process after a security review found vm's isolation alone insufficient.

Common follow-ups: What are documented ways code can escape a vm context?;What are more robust alternatives like isolated-vm or a separate process/container?

Security;Child Processes & Process Management
All 15 Core Node.js Modules questions