Executive brief
vm2 is a popular sandbox library for Node.js used to run untrusted code securely. A flaw in how the sandbox handles object properties allows restricted code to "leak" data or commands into the main host application. This can lead to a complete security bypass where an attacker gains control over the host system (Remote Code Execution).
Technical details
A vulnerability exists in the BaseHandler.set trap within bridge.js of vm2. The implementation ignores the ECMA-262 'receiver' parameter and unconditionally writes to the host target object. When a sandbox object inherits from a host proxy (e.g., via Object.create), property assignments that should be local to the receiver are instead written directly to the host-realm object. This allows an attacker to inject dangerous cross-realm Symbol keys, such as 'nodejs.util.promisify.custom', into host objects to achieve Remote Code Execution (RCE). The issue is patched in version 3.11.4.
Affected products
- patriksimek vm2 <= 3.11.3
Timeline
- 2026-05-17: patched: Fix committed to repository
- 2026-05-18: advisory: GHSA-c4cf-2hgv-2qv6 published
- 2026-06-12: disclosed: CVE-2026-47209 published to NVD