CVE-2026-93603: Improper Control of Generation of Code ('Code Injection') in patriksimek vm2
vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver — e.g. `fn()`, a detached method, `fn.call()`, `fn.apply(undefined)`, `Reflect.apply(fn, undefined, [])`, or `fn.bind()()` — the undefined receiver is passed straight through to the host call, and V8 substitutes the host realm's global object for `this`. vm2 then wraps and returns that object to the sandbox, giving sandboxed script a live proxy of the host global. This allows a complete sandbox escape: untrusted script can reach `process` and execute arbitrary code/commands on the host (for example via `process.getBuiltinModule('child_process').execSync`). Exploitation requires that the embedding application expose at least one non-strict host function to the sandbox; strict-mode and ES module host functions are not affected.
AI Analysis
Technical Summary
The vm2 library versions prior to 3.12.1 do not correctly handle calls to host-provided non-strict (sloppy-mode) functions without a receiver within the sandbox. When such functions are invoked with an undefined or null 'this' receiver, V8 substitutes the host realm's global object as 'this'. vm2 then wraps and returns this host global object to the sandbox, effectively granting sandboxed code a live proxy to the host environment. This allows untrusted sandboxed scripts to access sensitive host objects like 'process' and execute arbitrary commands, for example via 'process.getBuiltinModule('child_process').execSync'. Strict-mode and ES module host functions are not vulnerable. Exploitation requires the embedding application to expose at least one non-strict host function to the sandbox.
Potential Impact
Successful exploitation results in a complete sandbox escape, allowing untrusted code running inside the vm2 sandbox to execute arbitrary code and commands on the host system. This compromises the security boundary intended by the sandbox, potentially leading to full system compromise.
Mitigation Recommendations
A fix is available in vm2 version 3.12.1. Users should upgrade to vm2 3.12.1 or later to remediate this vulnerability. Until upgraded, avoid exposing non-strict (sloppy-mode) host functions to the sandbox. No other mitigations are specified.
CVE-2026-93603: Improper Control of Generation of Code ('Code Injection') in patriksimek vm2
Description
vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver — e.g. `fn()`, a detached method, `fn.call()`, `fn.apply(undefined)`, `Reflect.apply(fn, undefined, [])`, or `fn.bind()()` — the undefined receiver is passed straight through to the host call, and V8 substitutes the host realm's global object for `this`. vm2 then wraps and returns that object to the sandbox, giving sandboxed script a live proxy of the host global. This allows a complete sandbox escape: untrusted script can reach `process` and execute arbitrary code/commands on the host (for example via `process.getBuiltinModule('child_process').execSync`). Exploitation requires that the embedding application expose at least one non-strict host function to the sandbox; strict-mode and ES module host functions are not affected.
CVSS v4.0
Score 10.0critical
Affected software
patriksimek
vm2
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vm2 library versions prior to 3.12.1 do not correctly handle calls to host-provided non-strict (sloppy-mode) functions without a receiver within the sandbox. When such functions are invoked with an undefined or null 'this' receiver, V8 substitutes the host realm's global object as 'this'. vm2 then wraps and returns this host global object to the sandbox, effectively granting sandboxed code a live proxy to the host environment. This allows untrusted sandboxed scripts to access sensitive host objects like 'process' and execute arbitrary commands, for example via 'process.getBuiltinModule('child_process').execSync'. Strict-mode and ES module host functions are not vulnerable. Exploitation requires the embedding application to expose at least one non-strict host function to the sandbox.
Potential Impact
Successful exploitation results in a complete sandbox escape, allowing untrusted code running inside the vm2 sandbox to execute arbitrary code and commands on the host system. This compromises the security boundary intended by the sandbox, potentially leading to full system compromise.
Mitigation Recommendations
A fix is available in vm2 version 3.12.1. Users should upgrade to vm2 3.12.1 or later to remediate this vulnerability. Until upgraded, avoid exposing non-strict (sloppy-mode) host functions to the sandbox. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-18T11:00:32.756Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aad3d5d55bf5e2cf5100796
Added to database: 09/18/2026, 13:32:13 UTC
Last enriched: 09/18/2026, 13:46:53 UTC
Last updated: 09/18/2026, 22:12:52 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.