Executive brief
vm2 is a JavaScript sandbox that executes untrusted code in an isolated environment. A flaw in error handling fails to sanitize the ES2022 Error.cause property, allowing malicious sandbox code to obtain references to host objects like the Node.js process object, leading to full remote code execution on the server running the sandbox.
Technical details
The vulnerability exists in the handleException() function in lib/setup-sandbox.js, which recursively sanitizes certain error subtypes (SuppressedError and AggregateError) but completely overlooks the Error.cause property introduced in ES2022. When an embedder-exposed function throws an error with .cause referencing a host object (such as process), the sandboxed code can catch that error and traverse the .cause chain to access the host object directly, bypassing all sandbox protections. Attack requires the embedder to expose a host function that throws an error with .cause set to a sensitive host object; error chaining via new Error('msg', { cause: originalError }) is increasingly common in modern Node.js libraries. A fix involves adding .cause sanitization to handleException before the prototype-chain walk. Patch available in version 3.11.6.
Affected products
- Patriksimek vm2 <= 3.11.5
Timeline
- 2026-08-14: disclosed
- 2026-08-17: advisory
- 2026-08-14: patched: Fix available in version 3.11.6
References
- https://api.github.com/users/VladimirEliTokarev
- https://github.com/VladimirEliTokarev
- https://api.github.com/users/VladimirEliTokarev/gists%7B/gist_id%7D
- https://api.github.com/users/VladimirEliTokarev/repos
- https://avatars.githubusercontent.com/u/58337987?v=4
- https://api.github.com/users/VladimirEliTokarev/events%7B/privacy%7D