Brief Summary: CVE-2026-26332 — vm2 Sandbox Escape via SuppressedError Leading to Arbitrary Code Execution

Introduction

A sandbox escape in the vm2 Node.js package lets an attacker break out of the isolated execution environment and run arbitrary commands on the host system. It has a CVSS 3.1 base score of 9.8. For any application that relies on vm2 to run untrusted JavaScript safely, this vulnerability completely undermines the core security guarantee the library is designed to provide.

vm2 is an open-source sandbox and virtual machine module for Node.js, widely used to execute untrusted code in an isolated context. Platforms that need to run user-supplied scripts, plugins, or expressions without granting access to the host environment frequently adopt it. Its record in the National Vulnerability Database, and the number of security advisories it has accumulated, reflect both how widely it is used and how hard sandboxing JavaScript is to get right.

Technical Information

The root cause of CVE-2026-26332 is how vm2 handles the SuppressedError object. SuppressedError is a relatively new JavaScript error type associated with the Explicit Resource Management proposal (the using keyword and DisposableStack). The vm2 sandbox did not properly sanitize or proxy this error type, so sandboxed code could reach internal references to host-realm constructors.

The official GitHub security advisory (GHSA-55hx-c926-fr95) describes the attack in four steps:

1. The attacker creates a DisposableStack inside the sandbox and manipulates it to trigger a SuppressedError.
2. When the SuppressedError is caught, the attacker accesses e.suppressed.constructor.constructor. Because the sandbox's proxy layer did not properly wrap the SuppressedError object, this chain resolves to the host realm's Function constructor rather than the sandboxed one.
3. With a reference to the host's Function object, the attacker can construct and invoke arbitrary functions that execute outside the sandbox boundary.
4. The attacker uses this to require the node:child_process module and execute arbitrary system commands on the host, such as echo pwned.

The advisory confirms the exploit was demonstrated against Node.js version 24.13.0 running vm2 version 3.10.4.

The National Vulnerability Database maps this vulnerability to two CWE classifications:

CWE 94 covers the attacker's ability to inject and execute arbitrary code. CWE 693 covers the broader failure, since the sandbox protection mechanism itself was bypassed. Together they describe a complete breakdown of the isolation boundary vm2 is supposed to enforce.

In CVSS 3.1 terms, the attack is network accessible, has low complexity, needs no privileges or user interaction, and fully compromises confidentiality, integrity, and availability on the host.

Affected Systems and Versions

Any Node.js application that includes vm2 as a dependency at version 3.10.4 or earlier is vulnerable. The exploit was confirmed specifically on Node.js 24.13.0 with vm2 3.10.4, but the advisory indicates that all prior versions are affected.

Organizations should audit their dependency trees with tools such as npm ls vm2 or yarn why vm2 to find both direct and transitive dependencies on vulnerable versions.

Vendor Security History

The vm2 project has a documented history of sandbox escape vulnerabilities. The version 3.11.0 release that patches CVE-2026-26332 also addresses at least seven other security advisories, most of them Remote Code Execution flaws:

This many severe fixes in a single release suggests a systemic problem with holding the sandbox boundary. Each new JavaScript language feature (such as SuppressedError, DisposableStack, or changes to Proxy behavior) can introduce new attack surface that the sandbox has to account for. Security teams that rely on vm2 should weigh this track record in their risk assessments and decide whether the library's isolation guarantees are sufficient for their threat model.

References

• NVD: CVE-2026-26332
• GitHub Security Advisory: GHSA-55hx-c926-fr95 (Sandbox Escape Through SuppressedError)
• vm2 Release v3.11.0
• GitHub Advisory Database: GHSA-99p7-6v5w-7xg8
• Snyk: vm2 Security Vulnerabilities
• vm2 GitHub Repository