Executive brief
vm2 is a Node.js library that runs untrusted code in a restricted sandbox environment. This vulnerability allows an attacker to escape the sandbox and execute arbitrary code on the host system by accessing internal host objects and leveraging symbol extraction techniques to bypass security controls.
Technical details
vm2 contains a code-injection vulnerability (CWE-94) in its sandbox escape protections. The vulnerability stems from incomplete filtering of host object access; while commit ebcfe94 added some protections, they do not adequately prevent extraction of internal symbols and constructor access. An attacker can use techniques such as __lookupGetter__, Buffer.apply, and getOwnPropertySymbols on host objects to obtain Symbol(nodejs.util.inspect.custom) and forge custom inspect handlers. By combining this with WebAssembly.compileStreaming and the constructor property, arbitrary code execution can be achieved. The attack requires no authentication or user interaction—any code running within the vm2 sandbox can exploit this. A proof-of-concept demonstrates executing shell commands via process.getBuiltinModule('child_process').execSync. Version 3.11.0 includes fixes for this and related sandbox escape primitives.
Affected products
- patriksimek vm2 <= 3.10.5
Timeline
- 2026-05-07: disclosed
- 2026-05-01: patched: Version 3.11.0 released with fixes
- 2026-05-13: other: Published to NVD