vm2 Prototype Chain Escape via Function.prototype.call Stacking (CVE-2026-47698)

Overview

A second critical sandbox escape vulnerability in vm2 (CVE-2026-47698) was disclosed alongside CVE-2026-47686 on August 17, 2026. This flaw resides in both lib/bridge.js and lib/setup-sandbox.js, where the library fails to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators.

The result: sandboxed code can sever a host intrinsic's prototype chain and regain access to otherwise-blocked host objects — effectively escaping the sandbox. The vulnerability carries a CVSS score of 9.8 (Critical).

Vulnerability Details

Technical Analysis

Root Cause

vm2 proxies host-side objects to prevent sandbox code from accessing dangerous properties. These proxies intercept getter and setter access on host prototypes. However, the interception logic in lib/bridge.js and lib/setup-sandbox.js does not account for stacked Function.prototype.call invocations.

In standard JavaScript, Function.prototype.call can be used to invoke a function with an explicit this context. By layering multiple calls through Function.prototype.call — pointing each invocation at a dangerous getter or setter on a host prototype — sandbox code can circumvent vm2's proxy intercept layer. This allows the sandboxed code to:

1. Access host-realm prototype properties that vm2 intends to block
2. Sever the prototype chain of a host intrinsic from inside the sandbox
3. Regain a reference to the host's object graph, breaking containment

Attack Flow

1. Sandbox code obtains a reference to Function.prototype.call (normally allowed, as it appears safe in isolation).
2. The attacker builds a chain of nested .call() invocations targeting host prototype getters that vm2's proxy normally intercepts.
3. The stacked indirection bypasses vm2's proxy interception logic in bridge.js.
4. The attacker severs the prototype link between a host intrinsic and its shadow copy inside the sandbox.
5. The attacker now holds a direct reference to the host-side object, with no proxy barrier.

Impact

• Full sandbox escape — access to the host JavaScript runtime
• Arbitrary code execution in the Node.js host process
• Access to process, require, fs, and all host-side APIs
• Privilege escalation if the Node.js process runs with elevated permissions

Relationship to CVE-2026-47686

Both CVE-2026-47686 and CVE-2026-47698 were patched in vm2 3.11.6 and represent distinct but related escape vectors:

Both should be treated as equally critical. Organizations using vm2 should assume both escape paths are available to any adversary until the patch is applied.

Affected Versions

All versions of vm2 prior to 3.11.6 are vulnerable.

Remediation

Immediate Fix

Update vm2 to 3.11.6 or later:

npm install vm2@latest
# or
yarn add vm2@latest

Verification

node -e "const {version} = require('vm2/package.json'); console.log(version);"
# Expected: 3.11.6 or higher

Defence-in-Depth

Given that vm2 has now disclosed two critical escapes in the same release cycle, consider:

• Replacing vm2 with isolation mechanisms that operate at the OS or hypervisor level (e.g., Docker sandbox containers, AWS Lambda isolated functions, Deno's permission model, or Vercel Sandbox for ephemeral code execution).
• Never running untrusted code in the same process as sensitive data or credentials, regardless of sandbox guarantees.

Detection

Runtime Monitoring

Watch for unusual Function.prototype.call chains originating from vm2-sandboxed execution contexts. This is difficult to detect at runtime without instrumentation; focus on patching.

Dependency Scanning

Ensure your dependency scanner flags vm2 versions below 3.11.6:

npm audit
# Look for: vm2 < 3.11.6

Recommendations

• Update vm2 to 3.11.6+ immediately
• Patch both CVE-2026-47686 and CVE-2026-47698 — same update resolves both
• Evaluate replacing vm2 with OS-level sandboxing for higher-assurance environments
• Run npm audit to confirm no other vm2-related advisories remain open
• Consider Deno or isolated worker processes for untrusted code execution

Timeline

Sources

• NVD — CVE-2026-47698
• vm2 GitHub Repository

Related Advisories

• vm2 Error.cause Host Object Leak — CVE-2026-47686