logo

Database

Server side template injection In vm2

Description

vm2 has a Sandbox Escape Vulnerability

Summary

It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes

Details

https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L658

BaseHandler can be reached via util.inspect (same as https://github.com/patriksimek/vm2/commit/57971fa423abeb66f09e47e18102986549474ca8)

PoC

let obj = {
	subarray: Buffer.prototype.inspect,
	slice: Buffer.prototype.slice,
	hexSlice: () => '',
};

let sym;
...

Impact

Sandbox Escape -> RCE

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-440062. NVD-2026-440063. OSV-2026-440064. GHSA-qcp4-v2jj-fjx85. GCVE-2026-44006

References

1. https://github.com/patriksimek/vm2/security/advisories/GHSA-qcp4-v2jj-fjx82. https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L6583. https://github.com/patriksimek/vm2/releases/tag/v3.11.0

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.