vm2 WebAssembly Sandbox Escape RCE
CVE-2026-26956 is a critical sandbox escape vulnerability in vm2, the Node.js sandbox library. It affects vm2 3.10.4 and allows attacker-controlled code executed via VM.run() to escape the sandbox and achieve arbitrary code execution in the host process. The reported root cause is a protection mechanism failure in vm2’s JavaScript-layer isolation model: a crafted WebAssembly module using the try_table instruction together with a WebAssembly.JSTag catch handler can intercept a JavaScript exception at V8’s C++ layer before vm2’s exception sanitization and proxy-based mediation occur. The demonstrated exploit triggers a host-realm TypeError via Symbol-to-string coercion during stack formatting, returns that unsanitized exception object into attacker-controlled sandbox code, and then pivots through hostError.constructor.constructor to recover the host Function constructor. From there, the attacker can obtain the Node.js process object and execute host commands.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical vm2 sandbox escape vulnerability affecting Node.js v25 that uses a WebAssembly try_table instruction to bypass sanitization and achieve root-level code execution.
A critical vm2 protection mechanism failure that enables sandbox escape and arbitrary code execution by triggering a TypeError via Symbol-to-string coercion.
A vm2 sandbox escape vulnerability that can be exploited when an attacker can execute crafted WebAssembly inside a vm2 sandbox controlled by a vulnerable application.
A full sandbox escape vulnerability in vm2 for Node.js that allows arbitrary code execution on the host from attacker-controlled code executed inside VM.run().
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.