SB2026050493 - Multiple vulnerabilities in vm2

Description

This security bulletin contains information about 2 vulnerabilities.

1) Protection Mechanism Failure (CVE-ID: CVE-2026-26956)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a protection mechanism failure in VM.run() when processing attacker-controlled code that uses WebAssembly exception handling with JSTag support. A remote attacker can supply specially crafted code to obtain the host process object and execute arbitrary code.

Exploitation requires a Node.js version with WebAssembly exception handling and JSTag support.

2) Protection Mechanism Failure (CVE-ID: CVE-2026-24120)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary commands on the host system.

The vulnerability exists due to improper sandbox enforcement in the Promise species handling logic when processing attacker-controlled code inside a vm2 sandbox. A remote attacker can overwrite built-in functions to escape the sandbox and execute arbitrary commands on the host system.

Exploitation requires the ability to run arbitrary code inside the context of a vm2 sandbox.

Remediation

Install update from vendor's website.

References

• https://github.com/patriksimek/vm2/security/advisories/GHSA-ffh4-j6h5-pg66
• https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p
• https://github.com/patriksimek/vm2/blob/4b009c2d4b1131c01810c1205e641d614c322a29/lib/setup-sandbox.js#L35C7-L39