Executive brief
vm2 is a popular JavaScript sandbox used to safely execute untrusted code in Node.js applications. This vulnerability allows attackers to break out of the sandbox by accessing the host's prototype chain through console objects and overwriting core event handling mechanisms, effectively gaining full code execution with the privileges of the host process. Organizations using vm2 to isolate user-supplied scripts are at immediate risk of complete system compromise.
Technical details
This sandbox escape exploits the ability to access the host __proto__ getter/setter through console._stdout and console._stderr objects. The attack chain involves traversing the prototype chain (WriteStream → Socket → Duplex → Readable → Stream → EventEmitter) to gain access to EventEmitter.prototype, then overwriting the emit method. By triggering process events (such as exit or unhandledRejection), attackers execute arbitrary code in the process context. The vulnerability bypasses --disallow-code-generation-from-strings, which normally blocks code generation escapes. A fix is available in version 3.11.8.
Affected products
- vm2 vm2 before 3.11.8
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory published
- 2026-09-17: advisory: CVE-2026-92955 published
- 2026-09-17: patched: Patch available in version 3.11.8