Executive brief
vm2 is a popular Node.js library used to run untrusted code in a restricted 'sandbox' environment to prevent it from harming the host system. A critical flaw was found where an attacker can bypass these restrictions and execute commands directly on the host server. This could lead to a total system takeover, including the theft of sensitive data, credentials, and full control over the application's operations.
Technical details
A sandbox escape exists in vm2 due to improper handling of WebAssembly JavaScript Promise Integration (JSPI) surfaces. Specifically, `WebAssembly.promising` and `WebAssembly.Suspending` return Promise objects whose prototype chain points directly to the host realm's `Promise.prototype` without bridge proxy interposition. By using `Promise.prototype.finally()` and a species hijack, an attacker can capture a host-realm rejection object. This object's constructor can then be used to access the host's `process` object and execute arbitrary system commands. The vulnerability is most prominent in Node.js 26 where JSPI is enabled by default. The fix in version 3.11.4 removes the JSPI surface from the sandbox.
Affected products
- patriksimek vm2 <= 3.11.3
Timeline
- 2026-05-18: patched: Fixed in version 3.11.4
- 2026-06-12: disclosed: CVE-2026-47210 published