Executive brief
vm2 is a Node.js sandbox used to safely execute untrusted code with restricted access to system modules. This vulnerability allows attackers to escape the sandbox and execute arbitrary commands on the host system by exploiting how async generators handle exceptions and thenable objects. An attacker who can run code inside a vm2 sandbox can break out and achieve full remote code execution on the underlying server.
Technical details
The vulnerability exists in vm2's async generator implementation. An attacker can use the yield* expression inside an async generator to catch host exceptions. When the generator is closed using the return function with a thenable object (one with a .then method), exceptions thrown during the thenable resolution are caught by the runtime and passed to the yield* iterator. This allows the attacker to access host-realm objects and bypass sandbox isolation. The proof-of-concept demonstrates using this technique to access the process object and execute shell commands via child_process.execSync. The fix, released in version 3.11.3, wraps the async generator prototype methods (next, return, throw) to sanitize both iterator-result values and thenable arguments, preventing V8's promise handling from detecting user-supplied thenables that could bridge the sandbox boundary.
Affected products
- npm vm2 <= 3.11.2
Timeline
- 2026-05-14: disclosed: Vulnerability published
- 2026-05-11: patched: Patch released in version 3.11.3