Sandbox Violation in vm2 JavaScript Execution Environment by Patrik Simek

CVE-2026-92962

What is CVE-2026-92962?

The vm2 library, utilized for executing untrusted JavaScript in a secure sandbox environment, has a vulnerability in versions up to 3.11.3. This issue arises from the defaultSandboxPrepareStackTrace function, where it constructs its output using prototype-walking index assignment. This approach allows for an accessor to be installed on Array.prototype, which gets invoked when the sandbox code accesses error stack information. Although the vulnerability does not allow for a sandbox escape, it enables the interception and observation of stack trace information, which compromises the integrity of the sandbox. The issue has been addressed in version 3.11.4, where the installation of stack trace entries utilizes Reflect.defineProperty to enhance security.

References