Executive brief
A security flaw in the vm2 sandbox library allows untrusted code to bypass isolation boundaries. By using specific JavaScript Promise features, an attacker can gain direct access to the host environment's objects. This allows the attacker to view sensitive internal data or modify the state of the host application, potentially leading to a full compromise of the system running the sandbox.
Technical details
A vulnerability exists in vm2 where host object identity is preserved across the sandbox boundary during Promise resolution. The root cause is located in the Promise fulfillment wrapper within 'setup-sandbox.js', which utilizes 'ensureThis()' instead of a secure cross-realm conversion path like proxy wrapping. When 'ensureThis()' fails to find a prototype mapping, it returns the original host object to the sandbox. An attacker can exploit this by passing a host-side Promise to the sandbox; when it resolves, the '.then()' callback receives the raw host object. This allows the sandbox to perform identity checks via host-side WeakMaps, disclose host object properties, or perform write-through mutations on host state. The issue is fixed in version 3.11.0.
Affected products
- patriksimek vm2 <= 3.10.5
Timeline
- 2026-05-01: disclosed: Initial disclosure by patriksimek
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-11: patched: Version 3.11.0 released