Executive brief
vm2 is a popular JavaScript sandbox that isolates untrusted code from the host environment. Versions 3.11.4 through 3.11.6 fail to block certain internal Node.js stream symbols, allowing sandbox code to corrupt the state of host stream objects and bypass stream-safety checks. An attacker with code execution in the sandbox can trick the host into treating already-consumed streams as fresh, potentially bypassing security controls that rely on stream state verification.
Technical details
vm2 uses a fixed allowlist of dangerous registered Node.js symbols (e.g. nodejs.util.inspect.custom) to prevent sandbox code from accessing host internals across the sandbox boundary. However, this allowlist in lib/setup-sandbox.js and lib/bridge.js omits two newer symbols exposed in Node.js v25.8.0+: nodejs.stream.disturbed and nodejs.stream.errored. Sandbox code can extract these real host symbols via Object.getOwnPropertySymbols(streamWeb.ReadableStream.prototype) and write them as own properties on host stream objects, corrupting their internal state. The attack requires the embedder to expose a host WebStream object and the stream/web module to the sandbox. While not a direct code execution primitive, this breaks stream state verification and can bypass host logic that enforces one-shot stream consumption or rejects unsafe streams. Fixed in vm2 3.11.7.
Affected products
- patriksimek vm2 3.11.4 through 3.11.6
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-jf8q-945g-9q4c published
- 2026-09-17: advisory: CVE-2026-92952 assigned; NVD and VulnCheck published
- 2026-09-17: patched: vm2 3.11.7 released with fix