Description

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-09-17T14:17:57.513Z",
  "pubdate": "2026-09-17T14:17:57.513Z",
  "executiveSummary": "The vulnerability in vm2 versions prior to 3.11.8 constitutes a critical sandbox escape flaw stemming from an incomplete sanitization mechanism within the Error.cause handling logic.\nThe flaw specifically targets the handling of AggregateError objects, allowing an attacker to bypass cycle detection during exception traversal.\nBy manipulating host-wrapped error objects, an attacker can access unsanitized host proxies that would otherwise be restricted by the sandbox environment.\nSuccessful exploitation facilitates Remote Code Execution (RCE) and unauthorized disclosure of sensitive process information from the host machine.\nThis vulnerability is categorized as a sandbox escape, where the sandbox boundary is breached by exploiting the logic used to isolate host objects from the guest environment.\nThe impact is severe, as it effectively renders the isolation properties of vm2 void, granting an attacker the ability to execute arbitrary code with the privileges of the Node.js process hosting the sandbox.\nNo specific authentication or specialized privilege requirements are noted for the attacker, assuming they already have the ability to execute script code within the sandbox environment.",
  "technicalDetails": "The vulnerability resides in the exception handling mechanism of the vm2 sandbox, specifically within the logic responsible for sanitizing Error objects before they are passed back to the guest environment. The core issue involves an insufficient implementation of Error.cause sanitization when dealing with AggregateError objects.\nWithin the vm2 architecture, host objects are typically wrapped in proxies to prevent direct interaction with the host environment. The sandbox relies on a cycle detection mechanism within the handleException function to track visited objects and prevent recursive traversal of circular references. The vulnerability exists because the cycle detection logic is bypassed when dealing with revisited host-wrapped AggregateError objects during the traversal of the errors array.\nThe exploitation flow begins when an attacker triggers an AggregateError within the sandbox. By carefully crafting an error object that includes nested host-wrapped proxies, the attacker can force the handleException function into an execution path that fails to properly track the depth or state of the traversal. This failure allows the traversal logic to process host-wrapped errors that should have been sanitized or blocked.\nSpecifically, when the exception handler encounters these revisited objects, it erroneously permits access to the underlying host proxy embedded within the AggregateError. Because the proxy is no longer strictly sanitized, the guest code regains the ability to invoke methods and access properties on the host object that were intended to be restricted to the sandbox boundary.\nBy manipulating these exposed host proxies, an attacker can perform a series of operations to achieve RCE. This involves accessing powerful host-side globals or Node.js modules that are leaked through the proxy. Once an attacker obtains a reference to host-side functions (such as process-related methods), they can escape the sandbox context to run arbitrary system commands.\nThe lack of adequate cycle detection during the traversal of complex error trees allows the attacker to 'bridge' the gap between the isolated guest environment and the host's execution context. The exploitation process is highly reliable given the predictable nature of how vm2 handles exception propagation across the sandbox boundary.\nThis vulnerability affects all vm2 versions prior to 3.11.8. It does not require special network exposure beyond the capability to execute user-provided code within the vm2-protected sandbox. The post-exploitation state provides the attacker with full control over the process, facilitating total information disclosure and system compromise."
}