CVE-2026-47698: vm2 Sandbox Breakout via Host Prototype Mutators
A stacked-indirection bypass in vm2's sandbox bridge exposed dangerous host prototype mutators, allowing sandboxed JavaScript to escape and execute arbitrary commands on the host. Affects vm2 through 3.11.5; fixed in 3.11.6.
Summary
vm2’s protection against dangerous host prototype mutators could be bypassed by hiding the mutator behind an additional layer of call indirection. Code already executing inside a vm2 sandbox could use the gap to escape the sandbox and run arbitrary commands on the host.
Bypass
The earlier fix for GHSA-v6mx-mf47-r5wg detected this form:
indirectcall.call(dangerousmutator, ...)Its analysis did not follow one more level of indirection, so the dangerous mutator was no longer recognized when invoked as:
indirectcall.call(indirectcall, dangerousmutator, ...)The published proof of concept uses host __proto__ accessors and host errors produced by rejected WebAssembly.compileStreaming() calls to regain the host Function constructor and reach Node.js process APIs.
Impact
- CVSS: 9.8 Critical (
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - Complete sandbox escape and arbitrary command execution on the host
- Affected: vm2 <= 3.11.5
Exploitation assumes the attacker can supply JavaScript that an application runs inside a vm2 sandbox.
Status
Fixed in vm2 3.11.6 by commit a85acb6. The public advisory is GHSA-cfcw-xp6x-25gj, classified as CWE-913.
Credit
GitHub credits me, @lukefr09 as a reporter, alongside @XmiliaH, @the-vibe-dev, @oran-s, @dinhvaren, and @nil340.