Vulnerability in vm2-project (CVE-2026-26956, CVSS 9.8)

Summary

vulnerability in vm2-project (CVE-2026-26956). Successful exploitation can lead to full system takeover. Exploitable via catch.

Original description

The description as published by the source.

Summary

Full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation.

Details

Confirmed on: vm2 3.10.4, Node.js v25.6.1 (x64 Linux)
Trigger: Attacker-controlled code passed to VM.run()
Requires: Node.js version with WebAssembly exception handling + JSTag support (tested on v25.6.1)

vm2's sandbox security relies on two JavaScript-level mechanisms: (1) a code transformer that injects handleException() into JS catch clauses to wrap host-realm errors, and (2) bridge Proxies that wrap cross-context objects. Both operate entirely within JavaScript.

WebAssembly's try_table instruction with a JSTag catch handler catches JavaScript exceptions at V8's C++ level — below JavaScript entirely. When an imported JS function throws a TypeError produced by Symbol-to-string coercion during stack formatting (e.name = Symbol(); e.stack), the WASM try_table catches it as an opaque externref and returns it as a normal function return value. This WASM exception-handling-to-return-value path is not sanitized by vm2 — the host-realm TypeError reaches attacker code unsanitized. Its constructor chain (hostError.constructor.constructor) resolves to a Function that returns the host process object, allowing for reflection outside of the vm2 context, leading to code execution.

PoC

const { VM } = require("vm2");
console.log("vm2:", require("vm2/package.json")…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A severe security issue has been discovered in vm2, an open-source sandbox for Node.js. This vulnerability allows attackers to escape the sandbox and execute arbitrary code on the system, potentially taking over control. Similar issues have occurred in the past, particularly involving the unintended disabling of security mechanisms (CWE-693). The issue is fixed in version 3.10.5, and it is highly recommended that organizations update their software immediately.

The vulnerability in vm2 version 3.10.4 allows attacker code executed inside VM.run() to obtain the host process object and execute commands on the host. Affected versions are up to 3.10.4, and the issue is fixed in 3.10.5. The PoC exploits the WASM try_table instruction to catch JavaScript exceptions at the C++ level, leading to arbitrary code execution through unsanitized host errors. No workarounds are provided, thus an immediate update is recommended.

❓ What is the problem

vm2のVM.run()内でのフルサンドボックスエスケープと任意のコード実行が可能。

📍 Affected scope

vm2 version 3.10.4以下。

🔥 Severity

critical: リモート攻撃可能、認証不要、ユーザー操作不要。

🔧 How to fix

vm2をバージョン3.10.5に更新する。

🛡️ Workaround

素材から特定できず。

🔍 Detection

素材から特定できず。

Related past incidents Similar incidents extracted from past CVEs

CVE-2020-27101

Node.jsのsandbox escapeに関連するCVE。

CVE-2021-26701

TypeScriptコンパイラによるsandbox escapeの事例。

If this happens at your company Expected impact per business scenario

📌 ECサイトのバックエンドでvm2を利用している場合

攻撃者がサンドボックスを脱出してバックエンドの完全な制御を取得する可能性がある。

📌 社内開発環境で利用している場合

攻撃者が社内の開発サーバで任意のコードを実行できるリスクがある。

📌 マルチテナントサービスの一部としてvm2を使用している場合

一つのテナントが他のテナントやホストシステムを攻撃する可能性がある。

Recommended action

即座にvm2のバージョンを3.10.5にアップデートすること。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'vm2-project' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で vm2-project を grep し、稼働しているサービス・バージョンを把握する。
2
Match against affected range verify
```
Confirm if version satisfies `<= 3.10.4`
```
Step 1 で見つかったバージョンが影響範囲 <= 3.10.4 に該当するか照合。本番で稼働中ならインシデント扱い。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

npm vm2

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.5"}]}]

Vulnerability in vm2-project (CVE-2026-26956)

Summary

Original description

Summary

Details

PoC

AI summary

Related past incidents Similar incidents extracted from past CVEs

If this happens at your company Expected impact per business scenario

Response actions

Affected packages

References