Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T21:16:45.640Z",
  "pubdate": "2026-08-17T21:16:45.640Z",
  "executiveSummary": "A sandbox escape vulnerability exists in the vm2 open-source Node.js virtual machine prior to version 3.11.6. The flaw arises from inadequate restrictions in lib/bridge.js and lib/setup-sandbox.js regarding stacked indirection through Function.prototype.call combined with dangerous host prototype getter and setter mutators. This security deficiency allows untrusted code executing within the sandbox to manipulate and sever a host intrinsic's prototype chain.\nSuccessful exploitation of this vulnerability grants sandbox escape capabilities, enabling malicious sandbox code to traverse object references and access e.constructor.constructor. This ultimately achieves arbitrary host command execution within the underlying Node.js environment. The impact is critical, as it compromises the complete isolation boundary provided by the vm2 sandbox.\nThe vulnerability affects systems utilizing vm2 versions prior to 3.11.6. Attackers require the ability to execute arbitrary JavaScript code within the sandbox environment. No special authentication is required beyond initial code execution privileges inside the restricted sandbox context. Risk implications are severe due to the escalation from restricted sandbox execution to full host-level code execution.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization within lib/bridge.js and lib/setup-sandbox.js. Specifically, the sandbox environment fails to properly restrict stacked indirection patterns executed via Function.prototype.call when interacting with dangerous host prototype getter and setter mutators.\nDuring execution, untrusted code leverages stacked indirection to bypass existing security boundaries and target host intrinsics. By manipulating prototype getter and setter mutators, the sandbox code manages to sever a host intrinsic's prototype chain. This prototype manipulation breaks the intended isolation boundaries between the guest execution context and the host Node.js environment.\nOnce the prototype chain is severed and host intrinsics are exposed, the malicious payload reaches e.constructor.constructor. Access to the Function constructor via the constructor chain allows the attacker to synthesize arbitrary functions and execute arbitrary host commands outside the sandbox constraints.\nThe vulnerable components are specifically located in the bridge and sandbox setup logic within lib/bridge.js and lib/setup-sandbox.js. The affected software versions comprise all vm2 releases prior to 3.11.6. Exploitation does not require network exposure or authentication, as the attack vector relies entirely on executing a crafted payload within an already initialized vm2 sandbox instance."
}