Threat Intelligence Database

A vulnerability in patriksimek vm2 before version 3.11.2 allows attackers to access the internal sandbox state via the globalThis object. This occurs because the software fails to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. The issue is identified as CWE-227 and has a CVSS 4.0 score of 6.9, indicating medium severity.

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment (lines[lines.length] = value) rather than a prototype-bypassing define-property primitive. Because this bridge-internal array is allocated in the sandbox realm, code inside the sandbox can install an accessor on Array.prototype for the relevant index; the accessor is then invoked whenever the sandbox reads error.stack (or otherwise triggers Error.prepareStackTrace), allowing sandbox code to observe and intercept each stack-trace line written by the bridge. The same pattern is used in the error-handling (catch) branch. The values written are formatted strings only, so the practical impact is limited to an information side channel and a violation of vm2's bridge-container defense invariant rather than a sandbox escape; the vendor rates the issue Low. The issue is fixed in vm2 3.11.4, which installs each entry as an own data property via Reflect.defineProperty.

CVE-2026-92961 is a high-severity vulnerability in patriksimek vm2 prior to version 3.11.6. The vulnerability arises because vm2 fails to enforce the bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors. This allows attackers to allocate arbitrary host memory, potentially exhausting the host process memory and causing out-of-memory conditions.

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.

CVE-2026-92959 is a vulnerability in patriksimek vm2 versions before 3.11.8 where the allowAsync: false option is not fully enforced. Although the local Promise.prototype.then is patched to throw an error when async is disallowed, the sandbox's Promise static methods still allow attacker-supplied thenables to schedule asynchronous work. This enables sandboxed code to execute asynchronously after VM.run() or NodeVM.run() has returned, bypassing the configured timeout and continuing execution beyond the host's expected completion time.

CVE-2026-92958 is a high-severity vulnerability in the patriksimek vm2 library up to version 3.11.6. It involves a bypass of the builtin-module denylist in NodeVM, allowing sandboxed code to require certain filesystem submodules despite explicit denials. This enables unauthorized access to promise-based filesystem APIs such as fs/promises, potentially allowing file creation and modification. The issue is fixed in version 3.11.7.

vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7. (Suggested title: "vm2 before 3.11.7: NodeVM builtin deny-list bypass via node:-prefixed specifiers exposes child_process")

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling Symbol.species via Promise.prototype.finally, sandbox code receives that raw host error, walks from the host error constructor to the host Function constructor, and recovers the real host `process` object, gaining host Node.js capabilities (e.g. access to host modules such as fs) in the context of the process running the sandbox. No NodeVM, require permission, host object injection, or otherwise unsafe configuration is required. This is a bypass of the fix for GHSA-6j2x-vhqr-qr7q, which removed the JSPI entry points WebAssembly.promising and WebAssembly.Suspending. The issue is fixed in 3.11.7.

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.

CVE-2026-92954 affects the vm2 sandbox library for Node.js versions 3.10.0 through 3.11.7. The vulnerability involves unhandled rejected Promises returned from the host environment into the sandbox, which can cause the host Node.js process to terminate unexpectedly. This occurs because only Promises created inside the sandbox are properly wrapped with rejection handlers, while host Promises returned into the sandbox are not marked as handled. The issue was addressed and fixed in version 3.11.8.