Executive brief
VM2 is a JavaScript sandboxing library used to safely run untrusted code in isolation. This vulnerability allows an attacker with code execution inside the sandbox to escape and run arbitrary system commands on the host machine. An attacker can achieve full system compromise by manipulating prototype chains and WebAssembly error handling to gain access to Node.js internals and execute shell commands. This is a critical issue for any application that relies on VM2 to isolate user-supplied scripts.
Technical details
VM2 is vulnerable to a sandbox breakout via improper handling of prototype mutators and indirect function calls (CWE-913: Improper Control of Dynamically-Managed Code Resources). The vulnerability bypasses a previous fix (GHSA-v6mx-mf47-r5wg) by replacing direct dangerous calls with nested indirect calls through `indirectcall.call(indirectcall, dangerousmutator, ...)`, which are not flagged as dangerous by the sandbox's detection logic. An attacker with code execution inside the VM2 context can leverage this to manipulate prototype chains via `__lookupGetter__` and `__lookupSetter__`, then use WebAssembly error object manipulation to access the host's Node.js `process` object. Once access is gained, the attacker can call `child_process.execSync()` to execute arbitrary commands on the host with the privileges of the Node.js process. Patch version 3.11.6 fixes the issue; all versions ≤ 3.11.5 are vulnerable. No preconditions beyond initial code execution within the sandbox are required.
Affected products
- patriksimek vm2 <= 3.11.5
Timeline
- 2026-08-17: disclosed: Vulnerability published on GitHub Advisory Database
- 2026-08-14: patched: Fix released in version 3.11.6