CVE-2026-24120: Yet Another Sandbox Escape in vm2, or a Fundamental Design Problem? An analysis of CVE-2026-24120 in vm2, a sandbox for running JavaScript inside Node.js, has been published. Exploitation allows an attacker to escape the sandbox and execute commands on the host. Versions through 3.10.3 are affected, with the issue patched in 3.10.5. The CVE record the issue as an insufficient fix for CVE-2023-37466, which is related to Promise "Symbol.species". However, the author found that "resetPromiseSpecies", the mechanism responsible for this protection, remained unchanged in version 3.10.5. Instead, the developers strengthened exception handling by replacing "ensureThis()" with "handleException()". A separate patch also blocked "WebAssembly.JSTag", which provided another path for leaking a host-realm exception into sandbox code. The key operation in the PoC is "http://e.name = Symbol()". When "e.stack" is accessed, V8 attempts to convert "name" to a string, causing a "TypeError" in the host realm. Inside an async function, this causes the Promise to be rejected with a host-realm error. Once that object reaches sandbox code, the attacker can use "constructor.constructor" to reach the host "Function", access "process", and execute commands. The author traced five fixes for the same sandbox escape mechanism over 32 months: through different paths, host-realm objects repeatedly became accessible to code inside the sandbox. Just four releases — 3.10.5, 3.11.0, 3.11.1, and 3.11.2 — collectively addressed 18 security advisories. Moreover, one of the subsequent vulnerabilities was introduced by a hardening mechanism added in response to an earlier advisory. The vm2 README itself warns about the fundamental difficulty of building a reliable in-process JavaScript sandbox. The architecture of such a sandbox leaves a broad attack surface for new escape techniques to emerge. PoC: https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p Article: https://nefariousplan.com/posts/vm2-cve-2026-24120-readme-already-admits #dbugs_attacks
Post summary
The article discloses CVE-2026-24120 as a sandbox escape in vm2 that allows command execution, provides a PoC, details the vulnerability mechanism, and notes that the issue was patched in later releases.
