Socket: Critical vm2 Sandbox Escape

What it is

Socket's write-up of the critical vm2 sandbox escape GHSA-ffh4-j6h5-pg66 / CVE-2026-26956, and the free Certified Patch they released for it. vm2 is a Node.js library for running untrusted JavaScript in isolation (code playgrounds, plugin systems, workflow automation). The vulnerability lets attacker code passed to VM.run() break isolation, reach the host process object, and run arbitrary OS commands.

How it works

The escape abuses the presence of WebAssembly.JSTag in the sandbox environment. The fix shipped in vm2 3.10.5 works by removing WebAssembly.JSTag from the sandbox. Socket found that mitigation is absent not only from 3.10.4 but from every earlier release back to 0.2.2.

Preconditions / Affected

Three conditions must all hold — this is the filter that decides whether you care:

flowchart TD
    A[vm2 0.2.2–3.10.4<br/>66 releases] --> D
    B[Untrusted code reaches VM.run] --> D
    C[Node.js runtime exposes<br/>WebAssembly.JSTag] --> D
    D{All three true?} -->|yes| E[Critical: host command execution]
    D -->|no| F[Not exploitable]

Notably, the GitHub advisory currently says only 3.10.4 on "Node 25." Socket confirmed the exploit across 66 releases (0.2.2–3.10.4) on Node.js 24.15.0, and that Node.js 24 already exposes WebAssembly.JSTag. The accurate runtime condition is any Node.js version exposing WebAssembly.JSTag, not Node 25. Because scanners and SCA tools consume advisory metadata, the too-narrow range means vulnerable deployments may be marked unaffected — a reason not to rely on your scanner's verdict here.

What to do

Upgrade to vm2 3.10.5+ where possible. If a direct upgrade is not practical, apply the free Certified Patch:

socket patch add GHSA-ffh4-j6h5-pg66

The patch is free to anyone, including non-customers, for Critical/High vulnerabilities. After installing dependencies, ensure patches are applied as part of your build process — installing them is not enough.

Then:

• Check for direct and transitive vm2 usage.
• Identify services that pass untrusted JavaScript to VM.run().
• Confirm whether those services run on a Node.js version exposing WebAssembly.JSTag.
• Review whether sandboxed workloads can reach secrets, production credentials, the filesystem, or internal network resources — and run them least-privilege.
• Use stronger isolation (separate processes or containers) for untrusted code.

Caveats

Exposure varies by deployment — the page stresses this is critical only where all three preconditions coincide. The corrected 66-version range is Socket's own testing; the PR to fix the GitHub advisory was submitted, not yet merged. Given vm2's repeated history of sandbox escapes, Socket frames this as a prompt to reconsider the isolation model entirely, not just patch and move on.