Executive brief
vm2 is a popular software library used to run untrusted code in a secure, isolated 'sandbox' environment. A critical flaw allows an attacker to bypass these security restrictions and gain full control over the underlying server. This could lead to complete system takeover, data theft, or the installation of malicious software.
Technical details
A sandbox escape vulnerability exists in vm2 due to insufficient isolation in the 'neutralizeArraySpeciesBatch' method. The vulnerability arises because the method can be tricked into invoking getters on the host-side array prototype when processing objects from the sandbox. By defining a custom getter on the Array prototype, an attacker can leak host-side objects, including the host 'Function' object, into the sandbox environment. This allows for a complete breakout, enabling remote code execution (RCE) on the host system. The issue is fixed in version 3.11.2.
Affected products
- patriksimek vm2 < 3.11.2
- Red Hat Self-service automation portal 2 2
Timeline
- 2026-05-03: advisory: Original GitHub advisory published by maintainer
- 2026-05-13: disclosed: NVD publication date
- 2026-05-13: patched: Fix confirmed available in version 3.11.2