Executive brief
vm2 is a popular Node.js library used to run untrusted code in a secure, isolated sandbox. A flaw in how the library handles internal Node.js "symbols" allows code inside the sandbox to reach out and modify objects in the main host application. This could allow an attacker to hijack core functions like file reading or data processing, potentially leading to a full takeover of the host system.
Technical details
A sandbox escape exists in vm2 due to an incomplete override of 'Symbol.for' in setup-sandbox.js, which only intercepted 2 of 9 dangerous Node.js cross-realm symbols (e.g., nodejs.util.promisify.custom). Furthermore, the bridge's 'set', 'defineProperty', and 'deleteProperty' traps lacked 'isDangerousCrossRealmSymbol' checks. An attacker can obtain real cross-realm symbols via 'Symbol.for', write them to host objects exposed to the sandbox, and hijack host-side control flow (such as 'util.promisify' chains). This vulnerability is patched in version 3.11.4.
Affected products
- patriksimek vm2 <= 3.11.3
Timeline
- 2026-05-17: patched: Fix committed to repository
- 2026-05-18: advisory: GHSA-m5q2-4fm3-vfqp published
- 2026-06-12: disclosed: CVE-2026-47135 published to NVD