Description

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-17T14:18:01.160Z",
  "pubdate": "2026-09-17T14:18:01.160Z",
  "executiveSummary": "The vm2 sandboxing library is susceptible to a sandbox escape vulnerability arising from the failure to adequately protect host TypedArray and ArrayBuffer prototypes from mutation within the VM environment.\nThis vulnerability is categorized as a prototype pollution issue, allowing an attacker operating within the sandbox to traverse the prototype chain and modify critical objects in the host execution context.\nAffected versions include vm2 from 3.11.0 through 3.11.7.\nThe impact of this flaw is severe, as it grants an attacker the ability to manipulate host-level typed arrays, potentially leading to arbitrary code execution, unauthorized data access, or the bypass of security controls implemented in host-created objects.\nExploitation requires the attacker to execute untrusted code via VM.run(), providing them with a pivot point to inject malicious properties into the host's global prototype objects.\nNo specific authentication or network exposure is required beyond the ability to trigger the sandbox execution, making this a critical risk for applications processing user-supplied code.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient isolation of global object prototypes within the vm2 sandbox environment. Specifically, the library failed to properly intercept and sanitize prototype-walking operations that escape the intended sandbox boundaries.\nIn JavaScript, the prototype chain allows objects to inherit properties from their constructors. When vm2 attempts to provide a secure execution environment, it must ensure that sandbox-originated code cannot traverse the prototype chain to access or modify objects belonging to the host process.\nThe vulnerability occurs because the sandbox environment allows access to the internal prototypes of TypedArray, ArrayBuffer, and related constructors. An attacker can leverage this by using prototype-walking primitives (e.g., accessing __proto__ or constructor.prototype) to reach host-level objects that should be restricted.\nThe attack flow proceeds as follows: 1. The attacker executes malicious code inside the vm2 sandbox context using the VM.run() method. 2. The code utilizes prototype-walking techniques to traverse from an attacker-controlled object up to the prototype chain. 3. The attacker successfully identifies the host's Uint8Array.prototype, %TypedArray%.prototype, or ArrayBuffer.prototype. 4. The attacker injects malicious properties or overrides existing methods on these shared prototypes. 5. Once VM.run() finishes, the malicious modifications persist in the host environment. 6. When the host application subsequently instantiates new typed arrays, these objects inadvertently inherit the attacker-controlled properties, leading to anomalous behavior or direct execution of arbitrary logic in the host process.\nThis mutation of the host's runtime environment allows an attacker to manipulate the host's interaction with memory and data structures that rely on these prototypes. Because the prototype pollution affects the host execution context, the impact is not limited to the sandbox instance but extends to the entire Node.js process hosting the vm2 instance.\nThe vulnerability underscores a critical failure in enforcing the boundary between the sandboxed code and the host environment, specifically regarding the shared global state of prototype objects that are not adequately proxied or cloned."
}