CVE-2026-47209: vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

Synopsis

An integrity bypass vulnerability exists in the vm2 sandbox library for Node.js, caused by the BaseHandler.set Proxy trap incorrectly ignoring the receiver parameter when writing properties. The flaw is reachable over the network without authentication, as any application exposing vm2 sandbox execution to remote input is affected. Successful exploitation allows an attacker to inject properties (including dangerous cross-realm Symbol keys) onto host objects outside the sandbox, breaking the isolation boundary and enabling tampered host-object behavior. A patched-image rebuild at version 3.11.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target service over the network; any application that accepts remote input and passes it into a vm2 sandbox is exposed.

• AuthenticationNot required

  No credentials or account are needed; the vulnerability is exploitable by any unauthenticated caller who can submit input to the sandboxed execution path.

• Victim interactionNot required

  No user action is required; exploitation is fully attacker-driven without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layout, or other environmental preconditions.

Blast Radius

• Writes arbitrary properties onto host objects outside the vm2 sandbox, breaking the isolation boundary that prevents guest code from influencing the host Node.js process.
• Injects dangerous cross-realm Symbol keys (such as nodejs.util.promisify.custom) onto host objects, allowing an attacker to alter the behavior of built-in Node.js utilities in the host context.
• Bypasses any per-trap isDangerousCrossRealmSymbol guard on the direct set path, undermining future or existing defensive mitigations within vm2 itself.
• Does not directly expose stored data or crash the service, but tampered host-object state can chain into further exploitation of the host process.