Act nowDisclosed

Advisory · CVE-2026-93603

Critical vm2 sandbox escape gives host code execution

A flaw in vm2's bridge lets sandboxed code reach the host global object and execute arbitrary commands when a non-strict host function is exposed.

Advisory published September 19, 2026Independent summary
Vendor
vm2
Product
vm2
Identifier / CWE
CVE-2026-93603
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

vm2 is a playpen that is supposed to keep untrusted code away from the real computer. A bug in the fence lets the code reach through, grab the keys to the whole machine, and run any command it wants.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Exposed function

    The application exposes at least one non-strict host function to the vm2 sandbox.

  2. 02Missing receiver

    Sandboxed code calls that function with no receiver, so the undefined receiver passes straight through the bridge.

  3. 03Global leaks

    V8 substitutes the host realm's global object for the missing receiver, and vm2 hands a live proxy of it back to the sandbox.

  4. 04Host commands

    The sandboxed script reaches process and runs arbitrary host commands, for example via child_process.

What happened

A sandbox-escape vulnerability in vm2 (CVE-2026-93603, CVSS 10.0) affects releases through 3.12.0 and is fixed in 3.12.1. The flaw is in the bridge’s apply trap (lib/bridge.js): when sandboxed code calls a host-provided non-strict function without a receiver, the undefined receiver passes straight through, and V8 substitutes the host realm’s global object for this. vm2 then wraps and returns that object, giving sandboxed script a live proxy of the host global. From there, untrusted script can reach process and execute arbitrary host commands, for example via process.getBuiltinModule('child_process').execSync.

Exploitation requires the embedding application to expose at least one non-strict host function to the sandbox. Strict-mode and ES module host functions are not affected, according to the disclosure.

What to do

  1. Inventory applications and services that depend on vm2, including server-side plugin systems, online code runners, and template engines.
  2. Upgrade vm2 to 3.12.1 or later.
  3. Audit which host functions are exposed to sandboxes; prefer strict-mode or ES module functions, and minimize what the sandbox can reach.
  4. Review logs for unexpected child_process use or outbound commands from sandboxed workloads.
  5. Treat any vm2 deployment that ran untrusted code on an affected version as potentially compromised until investigated.

Management note

vm2 is one of the most widely embedded JavaScript sandboxes, and a 10.0 sandbox escape collapses the trust boundary it exists to provide. Patching is urgent, but the harder question is what untrusted code may already have run.