Sandbox Escape Vulnerability in vm2 by Patrik Símek

CVE-2026-93603

What is CVE-2026-93603?

The vm2 library, when used in versions 3.12.0 and earlier, is susceptible to a sandbox escape vulnerability caused by improper handling of a nullish 'this' reference in non-strict host functions. This allows untrusted scripts running in a sandbox to obtain direct access to the host environment's global scope, including sensitive processes like 'process.getBuiltinModule('child_process').execSync', enabling attackers to execute arbitrary commands. Successful exploitation hinges on the embedding application exposing at least one non-strict function to the sandbox, while strict mode functions remain secure.

References