CVE-2026-24120: Yet Another Sandbox Escape in vm2, or a Fundamental Design Problem?
Attack Techniques & Methods2026-08-26, 14:35
CVE-2026-24120: Yet Another Sandbox Escape in vm2, or a Fundamental Design Problem?
An analysis of CVE-2026-24120 in vm2, a sandbox for running JavaScript inside Node.js, has been published. Exploitation allows an attacker to escape the sandbox and execute commands on the host. Versions through 3.10.3 are affected, with the issue patched in 3.10.5.
The CVE record the issue as an insufficient fix for CVE-2023-37466, which is related to Promise
Symbol.species. However, the author found that resetPromiseSpecies, the mechanism responsible for this protection, remained unchanged in version 3.10.5. Instead, the developers strengthened exception handling by replacing ensureThis() with handleException(). A separate patch also blocked WebAssembly.JSTag, which provided another path for leaking a host-realm exception into sandbox code.The key operation in the PoC is
e.name = Symbol(). When e.stack is accessed, V8 attempts to convert name to a string, causing a TypeError in the host realm. Inside an async function, this causes the Promise to be rejected with a host-realm error. Once that object reaches sandbox code, the attacker can use constructor.constructor to reach the host Function, access process, and execute commands.The author traced five fixes for the same sandbox escape mechanism over 32 months: through different paths, host-realm objects repeatedly became accessible to code inside the sandbox. Just four releases — 3.10.5, 3.11.0, 3.11.1, and 3.11.2 — collectively addressed 18 security advisories. Moreover, one of the subsequent vulnerabilities was introduced by a hardening mechanism added in response to an earlier advisory.
The vm2 README itself warns about the fundamental difficulty of building a reliable in-process JavaScript sandbox. The architecture of such a sandbox leaves a broad attack surface for new escape techniques to emerge.
Vulnerabilities
Researchers
Vendors
Products