External risk intelligence

vm2 Sandbox Escape via Prototype Chain Manipulation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47698

vm2 is a sandboxing library integrated by developers into applications as a dependency. It is not an internet-facing service, appliance, or gateway itself. Exposure depends entirely on how a developer implements it within their own custom code, and it is not typically exposed directly to the public internet in its default or common usage.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the vm2 library for Node.js, which allows unauthorized execution of commands on the host system. The issue stems from flaws in how the library handles certain code execution pathways, potentially enabling malicious actors to bypass security controls within sandboxed environments. The main concern is confirming if this library is in use and potentially exposed.

Sandbox escape allows arbitrary host command execution.
Critical vulnerability in Node.js vm2 library.
Confirm usage and exposure of vm2 library.

Attack Path

How an attacker could exploit the issue

An attacker could execute arbitrary commands on the host system by leveraging a vulnerability in the vm2 sandbox's handling of prototype chain manipulations. This allows specially crafted code within the sandbox to break out and gain control over the host environment.

No special access needed.
Manipulates prototype chain.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

When vm2's sandbox is configured to expose certain host functionalities, a vulnerability in how it handles Function.prototype.call could allow malicious code within the sandbox to execute arbitrary commands on the host system. This could potentially impact system data and service behavior if the sandbox is used in a context where such access is granted.

Host commands may be executed.
Sandbox code could manipulate host prototypes.
Arbitrary command execution on the host.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vm2 sandboxing library's critical vulnerability requires immediate attention from development teams who own Node.js applications incorporating this dependency. The first practical step is to identify all instances of vm2 within your codebase, assess their reachability and criticality to business operations, and confirm the accountable development team. Subsequently, a remediation plan should be developed based on the identified risk, potentially involving coordinated vendor updates or temporary risk-reduction measures if direct patching is not immediately feasible.

Ownership: Development teams integrating vm2.
Verify first: Application reachability and business criticality.
Action: Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the vm2 library and how is it used?

vm2 is an open-source library for Node.js that creates isolated sandbox environments. Developers use it to run untrusted JavaScript code safely by attempting to restrict that code's access to the underlying host system's resources and sensitive functionality.

What does CWE-913 mean regarding CVE-2026-47698?

CWE-913 refers to improper control of generation of code, specifically involving dangerous dynamic code execution. In this CVE, the sandbox fails to block specific JavaScript patterns. This weakness allows malicious code inside the sandbox to manipulate the host's internal prototype structures, effectively breaking the security barrier to run commands on the host.

How can an attacker trigger this sandbox escape?

An attacker needs the ability to supply code that the vm2 sandbox executes. By crafting specific inputs that use stacked indirection via 'Function.prototype.call', they can manipulate host prototype getters and setters. Note that simply having the library installed is not enough; the code must be processed within a sandbox instance to attempt this manipulation.

Is my application at risk if I use vm2?

Risk depends on how you implemented the sandbox, as Halo Surface Signal notes that vm2 is a dependency integrated by developers rather than a standalone, internet-facing service. If your application processes untrusted user input within a vm2 sandbox, you are at higher risk. Evaluate whether your custom code exposes the sandbox to external actors.

Do I need to update vm2 immediately?

Yes, update to version 3.11.6 to resolve this vulnerability. Development teams should first perform an inventory to locate where vm2 is embedded in their codebase. Once located, assess if the sandboxed environments handle untrusted input, verify the responsible team, and prioritize patching the dependency to eliminate the flawed prototype handling logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.