CVE-2026-24118: VM2 Sandbox Breakout via __lookupGetter__ Method
Summary
CVE-2026-24118: VM2 Sandbox Breakout Through lookupGetter. Affects vm2 versions < 3.11.0. Fixed in 3.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
VM2 is a popular Node.js package that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code while preventing access to the host system. However, a critical vulnerability has been identified that allows attackers to escape this sandbox, leading to potential remote code execution.
Vulnerability Detail
The vulnerability arises from the __lookupGetter__ method, which can be exploited to access host context properties from within the VM2 sandbox. By using the host apply method accessible through Buffer, an attacker can invoke the host version of __lookupGetter__. This allows them to retrieve the host's Function.prototype and execute arbitrary code, including accessing sensitive system resources. The issue was partially addressed in a previous fix, but can still be circumvented using Object.getOwnPropertyDescriptor to access the constructor property.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.0
This is the first release that contains the fix.
npm install vm2@3.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the __lookupGetter__ method within the VM2 sandbox until you can update to the patched version. Additionally, consider restricting the use of VM2 in environments where untrusted code execution is not absolutely necessary.
Conclusion
The VM2 package has a critical vulnerability that allows sandbox breakout through the __lookupGetter__ method. It is essential to update to version 3.11.0 or later to mitigate this risk. Users should also consider using Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability allows attackers to execute arbitrary commands on the host system, leading to potential data breaches or system compromise.
Yes, version 3.11.0 and later of VM2 has addressed this vulnerability and is safe to use.
If you cannot update VM2 right away, avoid using the __lookupGetter__ method in your code and limit the execution of untrusted code in the VM2 environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
