Loading vulnerability…
vm2 Sandbox Escape via Buffer Prototype Accessor Abuse
CVE-2026-47131 is a critical sandbox escape vulnerability in the vm2 library for Node.js affecting versions prior to 3.11.4. The flaw arises from weaknesses in vm2's proxy-based isolation, specifically insufficient protection against prototype mutation through the proxy apply trap. By abusing accessor lookups against native Buffer objects using lookupGetter and lookupSetter, an attacker can surface a host-originated Node.js ERR_INVALID_ARG_TYPE exception and recover the host realm TypeError constructor. From there, the attacker can reach the host Function constructor and break out of the sandbox. The issue affects code executed inside vm2's VM sandbox and can be triggered with minimal attacker-controlled JavaScript, ultimately enabling arbitrary code execution in the host context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in complete sandbox escape from vm2 and arbitrary code execution in the host Node.js process. An attacker can execute operating system commands, access application secrets and local data available to the host process, interact with the filesystem and child processes, and fully compromise any trust boundary that relies on vm2 alone for isolation.
If you can’t patch tonight, do this now.
No effective configuration-only workaround is available when untrusted scripts are permitted to run inside vm2. Until patched, exposure can only be reduced by preventing execution of untrusted JavaScript or by placing the sandbox inside a stronger isolation boundary such as a separate process, container, microVM, or comparable OS- or hypervisor-enforced isolation layer. vm2 should not be treated as the sole security boundary for hostile code.
Patch, then assume compromise.
Upgrade vm2 to version 3.11.4 or later. The fix adds protections in the bridge logic to reject dangerous host prototype mutator functions before argument unwrapping in the apply trap, hardens host-value wrapping checks, and includes regression coverage for the known exploitation paths. Any deployment running untrusted JavaScript in vm2 versions up to and including 3.11.3 should be treated as vulnerable and updated immediately.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.