Executive brief
vm2 is a popular software library used to run untrusted code in a restricted 'sandbox' environment within Node.js applications. A critical vulnerability allows attackers to break out of this restricted environment and execute commands directly on the underlying server. This could lead to a full system takeover, unauthorized data access, or complete service disruption.
Technical details
A sandbox escape vulnerability exists in vm2 due to an insufficient fix for CVE-2023-37466. The original mitigation utilized a 'resetPromiseSpecies' function to protect the Promise species property; however, an attacker can overwrite 'Object.defineProperty' and 'Array.prototype.includes' to prevent this reset from occurring. By manipulating the 'Symbol.species' property of a Promise and triggering an error stack trace, an attacker can acquire the host's 'process' object. This allows for arbitrary command execution via 'child_process' on the host system. The vulnerability is reachable by any user capable of providing code to be executed within the vm2 sandbox. The issue is patched in version 3.10.5.
Affected products
- patriksimek vm2 <= 3.10.3
- Red Hat Red Hat Developer Hub 1
- Red Hat Self-service automation portal 2 2
Timeline
- 2026-05-01: advisory: GitHub Security Advisory GHSA-qvjj-29qf-hp7p published
- 2026-05-04: disclosed: CVE-2026-24120 published to NVD
- 2026-02-17: patched: Version 3.10.5 released to address the escape vectors
References
- https://github.com/patriksimek/vm2/releases/tag/v3.10.5
- https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p
- https://access.redhat.com/security/cve/CVE-2026-24120
- https://bugzilla.redhat.com/show_bug.cgi?id=2466529
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24120.json