Multiple Critical vm2 Sandbox Escapes Enable Host RCE in Node.js

A wave of disclosures has exposed multiple critical flaws in the Node.js sandbox library vm2, showing that untrusted JavaScript can break out of the sandbox and execute commands on the host. GitHub advisories describe several distinct escape paths affecting versions as old as 3.9.6 and, in some cases, up to 3.11.3, including a breakout through Node.js inspect, a Promise species bypass that defeats an earlier patch, prototype pollution through vm2’s bridge to host intrinsic prototypes, and a NodeVM misconfiguration path where nesting: true lets code bypass require: false and load vm2 recursively to reach modules such as child_process. Public proof-of-concepts show attackers recovering the host process object and invoking host commands, turning vm2 from a containment boundary into a route to full host compromise.

Additional reporting and upstream changes indicate the problems are broader than a single bug. Semgrep documented a new sandbox escape, while vm2 maintainers added regression tests covering descriptor- and prototype-traversal techniques used to recover host constructors such as Function, AsyncFunction, and GeneratorFunction, as well as callback sanitization bypasses tied to Promise handling. A later roundup described five critical vulnerabilities with no practical configuration-based workaround for deployments that execute untrusted code, and urged upgrades to vm2 3.11.4 or later. The advisory backlog on the project’s GitHub page shows a concentrated set of newly published sandbox escape, builtin bypass, and host code execution issues, underscoring that organizations relying on vm2 for isolation should treat affected environments as potentially compromised.