vm2 CVE-2026-47135

The target application must use vm2 at version <= 3.11.3 to execute attacker-controlled JavaScript and must also expose at least one non-protected host object (a function, plain object, Buffer, stream, etc.) to the sandbox via vm.setGlobal, vm.sandbox.x, or as an argument to a sandbox-callable function - a pure vm.run with no exposed host references yields no write target. Successful weaponization further requires that the host application subsequently performs an operation that consults one of the seven leaked symbol keys on the tampered object, specifically util.promisify(hostObj), Stream.isReadable/isWritable/isDuplex/isTransform duck-typing, or WebStream controller error dispatch - applications that never promisify or stream-check the exposed objects are unaffected even if vulnerable. CVSS lists AC:H reflecting the need to identify a chainable host-side consumer of the hijacked symbol semantics; PR:N and UI:N confirm no authentication or user interaction is needed beyond the existing ability to submit sandbox code. Pure host RCE is not directly achievable through this primitive because bridge function-wrapping still applies on crossing calls.

The CVSS 3.1 score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects an unauthenticated, network-vector, high-complexity attack with scope change and high confidentiality/integrity impact - appropriate for a sandbox escape where the attacker controls the input JavaScript fed to a vm2 instance. Real-world risk depends heavily on how vm2 is deployed: services that execute attacker-supplied code (online code runners, plugin systems, low-code/no-code platforms) are at high risk, while internal-only uses are largely shielded. Publicly available exploit code exists (the GHSA advisory includes a complete util.promisify hijack PoC and ATTACKS.md Category 8/20 documents sibling primitives), increasing the likelihood of opportunistic exploitation against exposed services. No EPSS score was supplied and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation signal - but vm2 has a long history of repeated escapes (the project was previously discontinued for exactly this class of issue), so any service still running vm2 at <= 3.11.3 should treat this as a priority patch. The author notes this is not a direct host RCE because bridge wrapping of crossing functions still applies; impact is semantic confusion and host-side control-flow steering, which can chain into broader compromise depending on how the embedder consumes promisified results or stream type checks.

A service that accepts user-supplied JavaScript (online sandbox, formula evaluator, server-side plugin) executes the code inside a vm2 VM that has exposed a host helper function via vm.setGlobal. The attacker's sandboxed code retrieves Symbol.for('nodejs.util.promisify.custom') - which passes through the incomplete filter - and assigns a malicious function under that symbol key on the exposed host function; when the host later calls util.promisify(hostFn)(arg), the attacker-controlled promise is returned, allowing the attacker to substitute fake data into host trust decisions (file contents, validation results, stream identity). A complete PoC for this chain is published in the GHSA advisory and in the vm2 ATTACKS.md document.