Junglewise Threat Intelligence

CVE-2026-26956: patriksimek vm2 sandbox escape via WebAssembly JSTag

CVE-2026-26956 · Severity: critical · CVSS 9.8 · Published 2026-05-04

Executive brief

vm2 is a popular software library used to safely run untrusted code in an isolated environment (sandbox). A critical vulnerability allows an attacker to bypass these security protections and execute commands directly on the underlying server. This could lead to a complete system takeover, unauthorized data access, or disruption of services.

Technical details

A sandbox escape vulnerability exists in vm2 due to improper isolation of WebAssembly (WASM) exception handling. While vm2 uses JavaScript-level transformers and Proxies to wrap host-realm errors, WASM's 'try_table' instruction with 'JSTag' catches exceptions at the V8 C++ level, bypassing these JS-level protections. An attacker can trigger a TypeError (e.g., via Symbol-to-string coercion during stack formatting) that is caught by WASM and returned as an unsanitized host-realm object. By traversing the constructor chain of this object, an attacker can access the host's 'process' object and achieve Remote Code Execution (RCE). The issue is patched in version 3.10.5.

Affected products

  • patriksimek vm2 <= 3.10.4
  • Red Hat Red Hat Developer Hub 1
  • Red Hat Self-service automation portal 2 2

Timeline

  • 2026-05-01: advisory: GitHub Security Advisory GHSA-ffh4-j6h5-pg66 published
  • 2026-05-04: disclosed: CVE-2026-26956 published to NVD
  • 2026-05-04: patched: Version 3.10.5 released to address the vulnerability

References

Related threats