Description

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-17T14:18:01.480Z",
  "pubdate": "2026-09-17T14:18:01.480Z",
  "executiveSummary": "The vm2 library, specifically versions prior to 3.11.8, is susceptible to a critical sandbox escape vulnerability within the NodeVM component.\nThis vulnerability stems from insufficient isolation, allowing untrusted code executed within the sandbox to gain access to the host-level __proto__ getter/setter via the console._stdout and console._stderr properties.\nBy manipulating these object prototypes, an attacker can overwrite EventEmitter.prototype.emit to redirect execution flow.\nThis allows the attacker to manipulate internal process events, ultimately leading to arbitrary code execution outside the restricted sandbox environment with full process-level privileges.\nThis flaw effectively negates the security boundaries established by the sandbox, bypassing intended code generation restrictions and other hardening mechanisms.\nThe vulnerability poses a severe risk to any application relying on vm2 for secure code execution, as it permits full host system compromise.\nExploitation does not require external network interaction, as the attacker must already be capable of executing arbitrary code within the sandboxed environment.",
  "technicalDetails": "The vulnerability resides in the NodeVM implementation of the vm2 sandbox, specifically regarding the exposure of host objects via the console interface.\nIn Node.js, the console module communicates with stdout and stderr streams. Within the NodeVM sandbox, these streams were inadvertently linked to host-level objects, providing an unintended bridge between the isolated sandbox environment and the host process context.\nThe root cause is the failure to properly wrap or isolate the __proto__ property accessible through these console stream objects. Because __proto__ provides access to the object's prototype chain, an attacker can traverse from the sandboxed environment up to the host process's global objects.\nThe exploitation flow begins with the attacker accessing the console._stdout or console._stderr objects within the NodeVM sandbox. By invoking the __proto__ getter, the attacker gains access to the host's underlying stream prototype.\nOnce the attacker has achieved reference access to the host prototype, they can perform prototype pollution or direct modification. The specific target identified is EventEmitter.prototype.emit. By overwriting this method, the attacker can intercept and hijack all events emitted within the host process.\nBy forcing the emission of specific process-related events, the attacker can trigger malicious callback functions that run in the context of the host process rather than the sandbox.\nThis technique effectively bypasses the vm2 sandbox's security policies, including restrictions on dynamic code generation and access to restricted modules like 'fs' or 'child_process'.\nOnce execution is elevated to the host process context, the attacker is no longer constrained by the NodeVM virtual machine boundaries. This allows for arbitrary command execution, access to the filesystem, and interaction with other sensitive system resources that the host process has access to.\nThe vulnerability is present in all versions of vm2 prior to 3.11.8. Exploitation requires the attacker to have the ability to execute script code within the NodeVM instance; however, given the nature of the library as a sandbox, this is the primary attack vector intended to be mitigated.\nNo special authentication is required for this exploit, provided the attacker has an entry point for code execution within the sandbox. The vulnerability is local to the Node.js process and does not rely on network exposure, though remote exploitation is possible if the sandbox processes untrusted user-supplied input."
}