Executive brief
vm2 is a popular software library used to run untrusted code in a secure, isolated "sandbox" environment. A critical vulnerability allows an attacker to break out of this isolation and execute unauthorized commands directly on the underlying server. This could lead to a full system takeover, data theft, or complete service disruption.
Technical details
A sandbox breakout vulnerability exists in vm2 due to improper handling of exceptions with a null prototype in the handleException function. When an object with a null prototype is thrown and caught, the sandbox incorrectly assumes the exception is proxied, allowing an attacker to access the host's Function object. This bypasses the isolation layer, enabling Remote Code Execution (RCE) on the host system. The vulnerability is reachable if an attacker can provide arbitrary JavaScript to be executed within the vm2 sandbox. This issue is fixed in version 3.11.2.
Affected products
- patriksimek vm2 < 3.11.2
- Red Hat Self-service automation portal 2 2
Timeline
- 2026-05-03: advisory: Original GitHub advisory published by patriksimek
- 2026-05-13: disclosed: CVE published to NVD
- 2026-05-13: patched: Fix released in version 3.11.2