vm2 CVE-2026-26956

No special conditions - remote unauthenticated exploitation against default configurations of vm2 3.10.4. Any application calling VM.run() or similar vm2 sandbox methods with attacker-controlled JavaScript input is vulnerable. Exploitation requires only the ability to pass JavaScript code to vm2's execution methods, which is the library's intended use case. Attack complexity is low (AC:L) because the escape techniques rely on standard JavaScript reflection APIs (Object.getOwnPropertyDescriptor, Proxy, util.inspect) available in all Node.js environments. No privileges (PR:N), no user interaction (UI:N), and no non-default configuration required. The only limiting factor is that the vulnerable application must be using vm2 3.10.4 specifically to sandbox untrusted code execution - applications not using vm2 or not exposing code execution to untrusted users are unaffected.

Critical real-world risk for any application using vm2 3.10.4 to execute untrusted code. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N accurately reflects the severity - remote unauthenticated attackers can achieve complete system compromise with low complexity. The S:U (unchanged scope) understates impact since sandbox escape typically represents scope change from contained to host. KEV status unknown from provided data. Public exploit code status unconfirmed, but the GitHub security advisory GHSA-ffh4-j6h5-pg66 and detailed release notes listing eleven distinct patches suggest security researchers have thoroughly mapped exploit paths. Any service exposing vm2-based code execution to untrusted users (e.g., online code playgrounds, plugin systems, serverless function sandboxes) faces immediate remote code execution risk. SSVC assessment: exploitation likely automatable (reflection APIs are deterministic), technical impact is total system compromise, and utilities like vm2 have high deployment in developer tooling. This is a patch-immediately scenario with no effective workarounds short of disabling the sandbox feature entirely.

An attacker submits malicious JavaScript code to a web service that uses vm2 3.10.4 to safely execute user-provided scripts (e.g., an online code playground or plugin system). The attacker's code exploits Function constructor leakage via getOwnPropertyDescriptor or util.inspect internal method exposure to obtain a reference to the host process object. With host process access, the attacker executes arbitrary commands (e.g., child_process.exec) to install backdoors, exfiltrate credentials, or pivot to internal network resources. The entire attack occurs within a single VM.run() invocation with no indication to the host application that sandbox boundaries were violated.