Critical vm2 Sandbox Vulnerability (CVE‑2026‑26956) Enables Host RCE in Node.js SaaS Environments
What Happened – A newly disclosed vulnerability (CVE‑2026‑26956) in the popular Node.js sandbox library vm2 allows attackers to escape the sandbox and execute arbitrary commands on the host system. The flaw stems from improper handling of WebAssembly exception handling and JSTag support, enabling a crafted TypeError to leak host objects and regain access to Node.js internals. Proof‑of‑concept exploit code has been published, and the issue affects vm2 v3.10.4 (and possibly earlier releases).
Why It Matters for TPRM –
- SaaS platforms, online coding services, and automation tools that embed vm2 are exposed to remote code execution, jeopardizing data confidentiality and service continuity.
- The library’s widespread adoption (≈1.3 M weekly npm downloads) means a large attack surface across multiple third‑party providers.
- Exploitation bypasses JavaScript‑level defenses, rendering traditional sandbox hardening ineffective.
Who Is Affected – Technology / SaaS vendors, cloud‑native development platforms, API providers, and any organization that integrates vm2 into production workloads.
Recommended Actions –
- Immediately upgrade vm2 to v3.10.5 or later (current v3.11.2).
- Review all codebases and CI/CD pipelines for vm2 dependencies; enforce version pinning.
- Verify that Node.js environments do not enable WebAssembly exception handling or JSTag support unless required.
- Conduct a focused security audit of any services that execute untrusted JavaScript via vm2.
Technical Notes – The vulnerability is a sandbox escape triggered by a crafted TypeError during Symbol‑to‑string conversion. WebAssembly exception handling intercepts the error at the V8 engine level, bypassing vm2’s JavaScript‑based proxy sanitization. The leaked host‑side error object can be used to reconstruct the process object, leading to arbitrary command execution. CVE‑2026‑26956 follows earlier vm2 escapes (CVE‑2026‑22709, CVE‑2023‑30547, CVE‑2023‑29017, CVE‑2022‑36067). Source: BleepingComputer