vm2 Sandbox Escape via Unsanitized Error.cause Leads to RCE (CVSS 9.9)

A publicly disclosed GitHub Security Advisory (GHSA-m283-3h24-438v, tracked as CVE-2026-47686) reports a sandbox escape in vm2 versions <= 3.11.3, rated CVSS 3.1 9.9. According to the researcher, the sandbox's handleException() function in lib/setup-sandbox.js sanitizes sub-errors nested inside SuppressedError and AggregateError objects, but never inspects the ES2022 Error.cause property. If embedder code exposes a host function that throws an Error with a .cause referencing a powerful host object (e.g. process), sandboxed code that catches the error can walk into e.cause and reach the host process directly. A public proof-of-concept reportedly demonstrates full command execution (child_process.execSync) from inside the sandbox.

Why It Matters

vm2 is a widely used Node.js sandboxing library for running untrusted code. Error chaining via new Error('msg', { cause: originalError }) is now standard practice in Node.js codebases, and the advisory notes this pattern is common in library wrappers, database adapters, and HTTP clients — meaning the prerequisite (an embedder throwing with .cause set to a host object) may already exist in many real-world integrations without developers realizing it creates an escape path. Any application relying on vm2 to isolate untrusted or third-party code should treat this as a critical, actively exploitable design flaw rather than a theoretical issue, since a working PoC is public.

What Defenders Should Do Now

• Inventory applications and services that depend on vm2, directly or via transitive dependencies, especially anything executing untrusted or user-supplied JavaScript.
• Review embedder code for any host functions exposed to the sandbox that throw errors with a .cause option — treat any such reference to process or other host objects as a potential escape vector until sanitization is confirmed.
• Watch for unexpected child-process spawning, file access, or network activity originating from processes that host vm2 sandboxes, as this could indicate exploitation.
• Track upstream for a patched release incorporating the suggested fix (sanitizing .cause ahead of the existing prototype-chain walk), and prioritize applying it given the CVSS 9.9 rating and public PoC.
• Where patching isn't immediately available, consider avoiding .cause in errors thrown from sandbox-exposed host functions, or evaluate migrating away from vm2, which has had prior sandbox-escape history.

Developing Intel

This is a same-day advisory and details may evolve as the maintainers respond and a fix ships. This post reflects only what has been publicly reported; consult the original advisory for the full technical writeup, reproduction steps, and any updates: GHSA-m283-3h24-438v.