Critical vm2 Sandbox Bug Lets Attackers Execute Code on Hosts
Patch vm2 to 3.10.5 or later immediately to prevent arbitrary host code execution.
Patch vm2 to 3.10.5 or later immediately.
Summary
On May 6 2026, a critical vulnerability (CVE‑2026‑26956) was disclosed in the Node.js sandboxing library vm2. The flaw allows attackers to escape the sandbox and execute arbitrary code on the host by exploiting WebAssembly exception handling and JSTag support in Node.js 25.6.1. A specially crafted TypeError using Symbol‑to‑string conversion leaks a host‑side error object into the sandbox, which can then be used to access the process object and run commands. The maintainer confirmed the issue affects vm2 v3.10.4 and earlier releases, and published a proof‑of‑concept that demonstrates remote code execution.
Users are urged to upgrade to vm2 v3.10.5 or later—currently the latest release is v3.11.2—to mitigate the risk. The advisory notes that similar sandbox escape bugs have plagued vm2 in the past, including CVE‑2026‑22709, CVE‑2023‑30547, CVE‑2023‑29017, and CVE‑2022‑36067. The vulnerability is only triggered in environments that enable WebAssembly exception handling and JSTag support, which are not enabled by default in most Node.js deployments. The PoC exploit shows that an attacker can achieve full host control once the sandbox is bypassed.
Key changes
- CVE‑2026‑26956 allows sandbox escape via WebAssembly exception handling and JSTag support in Node.js 25.6.1
- A crafted TypeError using Symbol‑to‑string conversion leaks a host‑side error object into the sandbox
- Leaked object’s constructor chain gives access to Node.js internals like process, enabling arbitrary command execution
- Maintainer recommends upgrading to vm2 v3.10.5 or later; latest release is v3.11.2
- Previous similar flaws include CVE‑2026‑22709, CVE‑2023‑30547, CVE‑2023‑29017, CVE‑2022‑36067
- The vulnerability is only triggered when WebAssembly exception handling and JSTag support are enabled
- PoC demonstrates remote code execution on the host machine
- Node.js 25.6.1 is the confirmed affected version