CVE-2026-47209: vm2 Sandbox Escape via Proxy Receiver Parameter Bypass

Technical summary

The BaseHandler.set trap in bridge.js fails to respect the Proxy specification's receiver parameter. When a child object inherits from a proxied object via Object.create and code assigns a property on that child, the trap unconditionally writes to the host target rather than creating an own property on the receiver. This allows an attacker to write cross-realm Symbol keys (such as nodejs.util.promisify.custom) to host objects, defeating the sandbox's isolation model. The vulnerability exists because the implementation calls otherReflectSet against the host target without checking whether receiver !== proxy, which the Proxy spec mandates as the condition for creating properties on the receiver instead.

Business impact

Organizations running vm2 to sandbox untrusted Node.js code face a direct compromise of the host runtime. An attacker can inject malicious symbols into host objects that alter the behavior of core Node.js utilities, potentially leading to code execution or credential theft on the system running the sandbox. This is particularly critical for platforms using vm2 for multi-tenant code execution, serverless runtimes, or REPL-like services where isolation is the primary security control.

Affected systems

vm2 versions prior to 3.11.4 are affected. The vulnerability applies to any deployment running an older version that processes untrusted code within the sandbox. There are no vendor products listed in the CVE record; vm2 is an open-source project maintained independently. Users should check their node_modules or package-lock files to determine their current version.

Exploitability

Exploitability is high. No authentication or user interaction is required—an attacker only needs to execute arbitrary code inside the vm2 sandbox (the threat model vm2 is designed to handle). The network attack vector and low attack complexity mean that any compromise of an application using vm2 to run untrusted code directly enables this attack. Proof-of-concept techniques leveraging Object.create and property assignment are straightforward for an attacker with sandboxed code execution.

Remediation

Upgrade vm2 to version 3.11.4 or later. This patch fixes the BaseHandler.set trap to properly respect the receiver parameter and create properties on inherited objects rather than leaking them to the host. After patching, verify that your application's dependency tree reflects the updated version and re-deploy to all environments.

Patch guidance

Update the vm2 package in your package.json to 3.11.4 or a newer version. Run `npm update vm2` or `yarn upgrade vm2` and thoroughly test your application with the patched version before rolling out to production. Pay special attention to any code that creates child objects from sandbox contexts or relies on property inheritance patterns. If you maintain a lock file, ensure it is regenerated and committed.

Detection guidance

Monitor for unexpected Symbol properties appearing on host objects that should only exist within the sandbox context. Log and alert on attempts to modify nodejs.util.promisify.custom or other well-known cross-realm symbols at runtime. In development, enable detailed error logging in the sandbox to catch property assignment attempts to inherited objects. Ensure your monitoring covers changes to core Node.js prototype chains and global object properties.

Why prioritize this

This is a HIGH severity vulnerability (CVSS 8.6) because it provides a direct sandbox escape for untrusted code execution scenarios—the core threat model vm2 is designed to prevent. The integrity impact is high, the attack requires no privileges or user interaction, and exploitation is achievable by anyone able to inject code into the sandbox. Organizations should treat this as a critical security update, particularly if vm2 is used to run user-supplied scripts or in multi-tenant environments.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects a network-accessible vulnerability with low attack complexity and high impact to system integrity. The scope is changed (sandbox → host), meaning the attacker can affect resources beyond the security scope of the vulnerable component. There is no confidentiality impact and no availability impact, but the ability to write dangerous symbols to the host object is a direct integrity violation that undermines the sandbox's core purpose.

Frequently asked questions