CVE-2026-47135: vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

Synopsis

This is a sandbox escape vulnerability in vm2, a widely used Node.js sandboxing library. An attacker can send a crafted payload over the network without any authentication, exploiting incomplete symbol interception in the sandbox setup and missing property-trap checks in the bridge layer to obtain real cross-realm JavaScript Symbols and write them to host objects. Successful exploitation gives the attacker full control over host-side behavior, confirmed via a working util.promisify hijack chain that breaks out of the sandbox entirely, enabling arbitrary code execution in the host Node.js process. A patched-image rebuild at version 3.11.4 is available on HarborGuard for environments running an affected version of vm2.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker submits a crafted payload to a publicly or internally exposed vm2-backed endpoint.

• AuthenticationNot required

  No credentials or session token are needed; the exploit works against an unauthenticated vm2 evaluation surface.

• Victim interactionNot required

  No user action is required; the attacker triggers the vulnerability entirely through their own network request.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must satisfy specific preconditions around symbol resolution timing and bridge trap invocation order, though a working proof-of-concept chain has already been demonstrated publicly.

Blast Radius

• The attacker escapes the vm2 sandbox entirely and executes arbitrary code in the host Node.js process.
• Host-side JavaScript objects are hijacked by overwriting cross-realm Symbol keys, giving the attacker control over built-in utility behavior such as util.promisify callbacks.
• All data accessible to the host process becomes readable, including environment variables, secrets loaded at runtime, and in-memory application state.
• The attacker can tamper with host application logic and persisted data through the now-compromised host process, though service availability is not directly impacted by this vector.