EUVD-2026-26993
GHSA-55hx-c926-fr95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted JS to vm2 sandbox
-
DeliveryBuild DisposableStack with throwing disposers
-
ExploitTrigger SuppressedError with Symbol error name
-
ExecutionWalk suppressed.constructor.constructor to host Function
-
PersistRetrieve real process and child_process
-
ImpactExecute arbitrary OS commands on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application actually executes untrusted, attacker-supplied JavaScript inside a vm2 VM/NodeVM instance (i.e. attacker input reaches vm.run()) on a vulnerable version (<= 3.10.4). The concrete trigger is the SuppressedError produced when multiple DisposableStack disposers throw during dispose(), combined with setting an Error's name to a Symbol to bypass sanitization - the published PoC requires DisposableStack/SuppressedError support, present on modern Node.js (confirmed on Node.js v24.13.0). What LIMITS exploitation is that vm2 must be in the data path for untrusted code; if the application only feeds trusted/static scripts to vm2, or uses vm2 merely as an unused transitive dependency, there is no exposure. No host-side authentication is required (PR:N) once code reaches the sandbox, and no user interaction is needed. |
| Impact | The signals are mostly aligned toward high priority but with one important nuance. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) reflects that any code reaching the sandbox achieves total host compromise with a scope change, and SSVC reinforces this with technical impact 'total' and automatable 'yes'. A reliable public PoC exists (SSVC exploitation: poc), making weaponization trivial for anyone running untrusted code through vm2. The counter-signal is EPSS at 0.06% (19th percentile) and no CISA KEV listing, indicating no observed mass exploitation in the wild. This is not a contradiction: the low EPSS reflects that vm2 is only exploitable in the specific deployment pattern where it actually executes untrusted attacker-supplied JavaScript - a real but not universal configuration - rather than a blanket internet-facing service. For organizations that do run untrusted code in vm2, this is a top-priority, drop-everything patch; for those who merely have vm2 as a transitive dependency without feeding it attacker-controlled input, the practical exposure is far lower. The PR:N rating is technically correct (no host authentication needed) but presumes the attacker can already submit code to the sandbox, which is the deployment premise of vm2 itself. |
| Exploit ScenarioDerived | An application uses vm2 to run user-submitted JavaScript (for example a code-playground, serverless function runner, formula/expression evaluator, or template engine). An attacker submits a small script that builds a DisposableStack with throwing disposers to produce a SuppressedError, walks its constructor chain to the host Function constructor, and obtains the real process object to call child_process.execSync. A public PoC demonstrating exactly this exists in the GHSA advisory, so exploitation requires no novel research and can be fully automated (SSVC automatable: yes). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 30, 2026
Sandbox escape leading to remote code execution in the vm2 Node.js sandbox library affects all versions prior to 3.11.0, where the JavaScript SuppressedError mechanism (combined with DisposableStack disposal) lets untrusted code running inside the sandbox reach a host constructor and execute arbitrary commands on the underlying server. Any application that relies on vm2 to safely run attacker-controlled or untrusted JavaScript is fully compromised, with a working proof-of-concept published in the GHSA advisory. There is publicly available exploit code but no confirmed active exploitation; the SSVC framework rates it POC, automatable, with total technical impact, while EPSS remains low at 0.06%.
Earlier versions of this analysis (2)
Sandbox escape leading to remote code execution affects the vm2 sandboxing library for Node.js in all versions prior to 3.11.0, where a flaw in the handling of the SuppressedError object lets untrusted code break out of the isolated VM context and execute arbitrary code on the host. Any application that relies on vm2 to safely run attacker-supplied or untrusted JavaScript is fully compromised. Publicly available exploit code exists (SSVC: PoC), though EPSS remains very low at 0.06%, and there is no public exploit identified as actively exploited in CISA KEV.
Remote code execution in vm2 (Node.js sandbox library) versions prior to 3.11.0 allows unauthenticated network attackers to escape the sandbox and execute arbitrary code on the host system. The SuppressedError vulnerability (GHSA-55hx-c926-fr95) is one of 13 full sandbox-escape primitives patched in this coordinated security release. CVSS 9.8 Critical reflects network-accessible, unauthenticated exploitation with no complexity barriers. No CISA KEV listing or public POC data at time of analysis, but vendor explicitly warns 'embedders running untrusted code should upgrade,' indicating active risk to production deployments using vm2 for sandboxing untrusted JavaScript execution.
RemediationAI
Vendor-released patch: vm2 3.11.0 - upgrade immediately to 3.11.0 or later, which closes this SuppressedError escape along with 12 other advisories in a coordinated security release (commits 119fd0aa, 4cb82cc9, and others referenced in GHSA-55hx-c926-fr95). Because vm2's entire purpose is isolating untrusted code and multiple independent escape primitives were just disclosed, upgrading is the only robust fix; partial workarounds are unreliable. If you cannot patch instantly, the most effective compensating control is to stop feeding attacker-controlled or untrusted JavaScript into vm2 until the upgrade lands - disable or gate any feature that lets external input reach vm.run(), at the cost of losing that functionality temporarily. Given the long history of vm2 sandbox escapes, strongly consider migrating untrusted-code execution to a process- or VM-level isolation boundary (e.g. isolated-vm, a separate hardened worker process, gVisor/container, or a serverless sandbox), which provides a real OS-enforced boundary rather than an in-process JavaScript one. Refer to the GHSA advisory (https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95) and the v3.11.0 release notes for the full advisory set.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vm2 (npm package 'vm2', CPE cpe:2.3:a:patriksimek:vm2) is a widely used Node.js library designed to execute untrusted JavaScript in an isolated context with controlled access to host resources - it is the security boundary itself, so any escape is critical. The root cause is CWE-94 (Improper Control of Generation of Code / code injection) realized as a sandbox-escape primitive: the ECMAScript SuppressedError object, produced when multiple disposers in a DisposableStack throw during dispose(), carries a 'suppressed' error reference whose prototype chain was not fully sanitized by vm2's bridge. By manipulating an Error's name to a Symbol and triggering stack evaluation, the attacker obtains an un-sanitized error object, walks e.suppressed.constructor.constructor to reach the host realm's Function constructor, and from there retrieves the real process object and child_process to run shell commands. This is one of 13 advisories closed in the v3.11.0 coordinated release, several of which are full sandbox-escape RCE primitives stemming from incomplete prototype/intrinsic sanitization across realm boundaries.
Know when Vm2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Untrusted code in the sandbox needs no host auth (PR:N) and a reliable PoC makes it low-complexity (AC:L); escape from sandbox to host is a scope change (S:C) yielding full host compromise (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
Executive ViewAI
vm2 Node.js sandbox library versions before 3.11.0 contain a critical vulnerability enabling remote code execution through sandbox escape. Organizations that deploy vm2 to isolate untrusted JavaScript face complete compromise of that security boundary, allowing attackers operating system command execution. Patching to version 3.11.0 is required for all affected deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
vm2 is an advanced vm/sandbox for Node.js. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitab
vm2 is a sandbox that can run untrusted code with Node's built-in modules. Rated critical severity (CVSS 10.0), this vul
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 10.
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15,
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 10.
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Full sandbox escape with arbitrary code execution allows remote attackers to break out of vm2's Node.js sandbox environm
Sandbox escape in vm2 for Node.js allows remote unauthenticated attackers to execute arbitrary commands on the host syst
Sandbox escape in vm2 (patriksimek/vm2) versions prior to 3.11.3 enables remote code execution on the host Node.js proce
Sandbox escape in vm2 Node.js sandbox before 3.10.2 via Promise.prototype.then/catch callback sanitization bypass. PoC a
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 9.8
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the We
Exploit-DB