CVE-2026-26956: vm2 Sandbox Escape RCE Vulnerability

CVE-2026-26956 Overview

CVE-2026-26956 is a sandbox escape vulnerability in vm2, an open-source virtual machine and sandbox library for Node.js. Version 3.10.4 fails to fully isolate guest code from the host process. Attacker code running inside VM.run() can obtain a reference to the host process object and execute arbitrary host commands without any cooperation from the embedding application.

The issue is tracked under CWE-693: Protection Mechanism Failure and is patched in vm2 version 3.10.5.

Critical Impact

Untrusted JavaScript executed inside vm2 3.10.4 escapes the sandbox and runs arbitrary commands on the host with the privileges of the Node.js process.

Affected Products

• vm2 Node.js library, version 3.10.4
• Node.js applications embedding vm2 3.10.4 to execute untrusted JavaScript
• Downstream packages and services that depend on vm2 3.10.4 transitively

Discovery Timeline

• 2026-05-04 - CVE-2026-26956 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-26956

Vulnerability Analysis

The vm2 library wraps Node.js's built-in vm module to provide an isolated execution environment for untrusted code. Its security model depends on preventing guest code from accessing host objects such as process, require, and the global constructor chain.

In version 3.10.4, the protection mechanism that mediates references between the guest context and the host fails. Code passed to VM.run() reaches the real host process object instead of the proxied counterpart. Once an attacker holds a reference to process, calling process.mainModule.require('child_process').execSync() or equivalent yields full command execution on the host. No callback, custom resolver, or cooperative API surface is needed from the embedding application.

Root Cause

The vulnerability is a Protection Mechanism Failure [CWE-693]. The sandbox boundary between guest code and the host context does not consistently sanitize or proxy intrinsic objects, leaving a path through which the host process global is reachable from inside VM.run(). Refer to the GitHub Security Advisory GHSA-ffh4-j6h5-pg66 for the upstream technical description.

Attack Vector

Exploitation requires only the ability to submit JavaScript to an application that evaluates it through vm2 3.10.4. Common exposure points include online code playgrounds, serverless function evaluators, templating engines, formula and rule engines, chatbot plugins, and CI/CD steps that run user-supplied scripts. Because the attack is network-reachable and requires no privileges or user interaction, any service that accepts and executes guest JavaScript is in scope.

The vulnerability is described in prose only; no verified public proof-of-concept code is referenced in the advisory at the time of writing. See the vm2 v3.10.5 release notes for the patch details.

Detection Methods for CVE-2026-26956

Indicators of Compromise

• Node.js processes spawning unexpected child processes such as sh, bash, cmd.exe, powershell.exe, or curl from a service that normally only evaluates JavaScript.
• Outbound network connections originating from the Node.js process to attacker-controlled hosts shortly after a user submission.
• Filesystem writes by the Node.js service to paths outside its working or temporary directories.
• Presence of vm2 version 3.10.4 in package-lock.json, yarn.lock, or npm ls vm2 output across production hosts.

Detection Strategies

• Inventory all Node.js services and scan dependency manifests for vm2@3.10.4, including transitive dependencies.
• Audit application logs for guest scripts containing references to constructor, process, mainModule, require('child_process'), or Function('return this')().
• Use endpoint telemetry to flag any child_process creation by services whose baseline behavior excludes shell invocation.

Monitoring Recommendations

• Alert on Node.js parent processes spawning shells, interpreters, or networking utilities.
• Monitor egress traffic from sandbox-hosting services and baseline expected destinations.
• Track changes in installed npm package versions across the fleet and alert on rollbacks to vm2 3.10.4.

How to Mitigate CVE-2026-26956

Immediate Actions Required

• Upgrade vm2 to version 3.10.5 or later in every project, including transitive dependencies, and redeploy affected services.
• Treat any service that ran vm2 3.10.4 with untrusted input as potentially compromised and review host logs for command execution.
• Rotate credentials, tokens, and keys accessible to the Node.js process if exploitation cannot be ruled out.

Patch Information

The maintainers fixed the sandbox escape in vm2 3.10.5. Update via npm install vm2@3.10.5 or yarn add vm2@3.10.5 and verify with npm ls vm2. See the vm2 v3.10.5 release and GHSA-ffh4-j6h5-pg66 for advisory details.

Workarounds

• If immediate upgrade is not possible, disable code paths that pass untrusted input to VM.run() until the patched version can be deployed.
• Run the Node.js process under a dedicated low-privilege user inside an OS-level sandbox such as a container with seccomp, AppArmor, or gVisor to limit blast radius.
• Apply strict input validation and allowlisting to any JavaScript submitted by users, recognizing that these controls do not close the underlying sandbox escape.
• Consider migrating long-term to actively maintained isolation primitives such as isolated-vm or out-of-process workers with strong OS-level boundaries.