diff --git a/lib/internal/vm.js b/lib/internal/vm.js
index 7164fcd6ab2b77..32bcdf06234b67 100644
--- a/lib/internal/vm.js
+++ b/lib/internal/vm.js
@@ -22,7 +22,7 @@ const {
 } = require('internal/errors').codes;
 
 function isContext(object) {
-  validateObject(object, 'object', { allowArray: true });
+  validateObject(object, 'object', { __proto__: null, allowArray: true });
 
   return _isContext(object);
 }
@@ -68,7 +68,7 @@ function internalCompileFunction(code, params, options) {
   validateArray(contextExtensions, 'options.contextExtensions');
   ArrayPrototypeForEach(contextExtensions, (extension, i) => {
     const name = `options.contextExtensions[${i}]`;
-    validateObject(extension, name, { nullable: true });
+    validateObject(extension, name, { __proto__: null, nullable: true });
   });
 
   const result = compileFunction(
diff --git a/test/parallel/test-vm-source-map-url.js b/test/parallel/test-vm-source-map-url.js
new file mode 100644
index 00000000000000..22bfc55550e456
--- /dev/null
+++ b/test/parallel/test-vm-source-map-url.js
@@ -0,0 +1,27 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const vm = require('vm');
+
+function checkSourceMapUrl(source, expectedSourceMapURL) {
+  const script = new vm.Script(source);
+  assert.strictEqual(script.sourceMapURL, expectedSourceMapURL);
+}
+
+// No magic comment
+checkSourceMapUrl(`
+function myFunc() {}
+`, undefined);
+
+// Malformed magic comment
+checkSourceMapUrl(`
+function myFunc() {}
+// sourceMappingURL=sourcemap.json
+`, undefined);
+
+// Expected magic comment
+checkSourceMapUrl(`
+function myFunc() {}
+//# sourceMappingURL=sourcemap.json
+`, 'sourcemap.json');