CVE-2026-47135: vm2 Sandbox Escape via Cross-Realm Symbol Injection

Technical summary

The vulnerability stems from incomplete Symbol protection in setup-sandbox.js. The sandbox intercepts Symbol.for() to prevent access to dangerous cross-realm symbols, but only covers 2 of 9 critical symbols. More critically, the bridge's set, defineProperty, and deleteProperty traps lack isDangerousCrossRealmSymbol checks, creating a path for sandbox code to write unfiltered cross-realm symbols to host objects. By leveraging this mechanism, an attacker can chain symbol injection to compromise host APIs—the disclosed proof-of-concept demonstrates hijacking util.promisify to gain execution control. This is a symbol-based sandbox escape, not a memory corruption issue.

Business impact

Organizations relying on vm2 to safely execute user-supplied JavaScript (e.g., plugin systems, configuration scripts, serverless execution platforms) face significant risk. An attacker can escape the sandbox and execute arbitrary code in the host Node.js process, leading to data theft, host compromise, lateral movement to other services, and potential supply-chain exposure if vm2 is embedded in widely distributed tools. The attack requires no special privileges and can be triggered remotely if the application exposes sandbox execution as a service.

Affected systems

vm2 versions prior to 3.11.4 are affected. The vulnerability has no vendor/product designation in public advisories at this time, but any application or library that directly imports and uses vm2 for sandboxing is at risk. This includes Node.js applications that use vm2 for plugin isolation, dynamic code execution, or multi-tenant script execution.

Exploitability

Exploitation requires the attacker to provide code that runs inside the vm2 sandbox—a capability that must exist in the application design. The attack complexity is high (AC:H) because it involves understanding symbol mechanics and the bridge's property traps, but once weaponized, no additional privileges or user interaction are needed. Remote triggering is possible if the application accepts external code submissions. Public proof-of-concept code showing the util.promisify chain has been documented, raising the likelihood of derivative exploits.

Remediation

Upgrade vm2 to version 3.11.4 or later immediately. This patch extends Symbol.for interception to cover all 9 dangerous cross-realm symbols and adds isDangerousCrossRealmSymbol checks to the bridge's property traps. After patching, test your application's sandbox behavior to ensure compatibility. For users unable to patch immediately, consider restricting sandbox access to trusted code only or disabling vm2 in favor of other isolation mechanisms (e.g., Worker threads with message passing, child processes, or external services).

Patch guidance

Patch version 3.11.4 is available and recommended. Update your package.json or lockfile to reference vm2@^3.11.4 or higher, then run npm update or equivalent. Verify the patch by checking the package metadata and running a quick integration test on sandboxed code execution. If your application pins vm2 to a specific version, update the pinned version constraint. Monitor vm2 releases for any follow-up security updates, as symbol-based escapes may require iterative hardening.

Detection guidance

Monitor application logs for unexpected calls to util.promisify or other core Node.js utilities from within sandbox contexts—these may indicate exploitation attempts. Intrusion detection systems (IDS) can look for unusual property access patterns on host objects or unexpected Symbol creation within sandboxed environments. Code review of user-supplied scripts should flag any attempts to access Symbol global, Symbol.for, or reflect-based operations. If your application logs sandbox errors, watch for TypeError or property-related exceptions that might indicate failed escape attempts.

Why prioritize this

This vulnerability merits immediate patching (within 48–72 hours for critical systems). The CVSS score of 8.7 (HIGH) reflects high integrity and confidentiality impact with network-accessible attack surface. The practical demonstration of a full hijack chain (util.promisify) and the ease of exploitation once sandbox access is granted make it a real and present danger. Organizations using vm2 for multi-tenant execution, untrusted plugin loading, or external API-driven code execution should prioritize this above routine updates.

Risk score, explained

CVSS 3.1 score of 8.7 is driven by: (1) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C—network-accessible attack vector, high complexity (symbol chaining), no privileges required, and scope change (sandbox → host), combined with (2) High confidentiality and integrity impact (C:H/I:H), meaning the attacker can read and modify host state. The absence of availability impact (A:N) reflects that the escape does not directly crash the host. AC:H reflects the need for attacker ingenuity in crafting the exploit, but this does not reduce urgency given published proof-of-concept.

Frequently asked questions