vm2 EUVD-2026-81584

Requires that the host application actually runs attacker-controlled JavaScript inside a vulnerable vm2 instance (version before 3.11.8) - this is vm2's normal use case, so it is not an exotic prerequisite. Beyond that, the attacker must specifically craft a host-wrapped AggregateError that is revisited within a single exception-handler traversal so that handleException's cycle-detection is bypassed and an unsanitized host proxy in the errors array is reached. Limiting factors: exploitation is not fully trivial (CVSS AC:H/AT:P) because the malformed-error/traversal condition must be arranged precisely; no authentication or user interaction is needed once untrusted code reaches the sandbox; environments that do not execute untrusted code in vm2, or that have migrated off vm2 (deprecated since 2023), are not exposed.

This is a genuine high-priority issue where the CVSS signals and the technical facts align rather than conflict. The vendor CVSS 4.0 score of 9.5 reflects a full sandbox escape from vm2 to the Node.js host, yielding remote code execution and process information disclosure - the most severe outcome possible for a sandbox library, whose entire purpose is to contain untrusted code. The vector correctly encodes AV:N, PR:N, UI:N (any untrusted script the app runs can attempt it) alongside AC:H and AT:P, which honestly capture that the attacker must craft a specific revisited host-wrapped AggregateError to defeat the cycle-detection logic in handleException - this is not a trivial one-liner. Scope-change metrics (SC:H/SI:H/SA:H) are justified because the impact crosses the sandbox/host trust boundary. However, EPSS is not provided, this CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no evidence of active exploitation - the priority derives from impact severity and the low bar of the vm2 threat model (many apps deliberately feed attacker code to vm2), not from confirmed in-the-wild use. One data caveat worth flagging: the cited fixed version 3.11.8 does not match publicly-known vm2 release history (the project stopped at 3.9.19 and was deprecated in 2023 in favor of isolated-vm) - verify the exact affected/fixed versions with the vendor advisory.

An application uses vm2 to sandbox untrusted or user-supplied JavaScript (e.g., a code playground, serverless function runner, or template/formula engine). The attacker submits script that constructs and throws a host-wrapped AggregateError whose errors array is revisited during a single exception-handler traversal, defeating handleException's cycle detection so an unsanitized host proxy is exposed. Grabbing that proxy, the attacker pivots to the Node.js host to execute arbitrary code and read process information. No public POC is referenced, but this is the classic vm2 escape pattern and the flaw is an incomplete fix of prior Error.cause sanitization.