Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a sandbox escape in the vm2 library, identified as CVE-2026-26956. The root cause is the improper sanitization of the sandbox environment, specifically the failure to remove the WebAssembly.JSTag object in Node.js versions that support it.
The VM class constructor is responsible for setting up the sandboxed environment. In vulnerable versions, it neglects to remove WebAssembly.JSTag, leaving a security hole. An attacker can exploit this by supplying malicious JavaScript code to the VM.run method.
The exploit involves using a WebAssembly module with a JSTag-based exception handler. This allows the attacker's code to catch a specially crafted JavaScript error at the V8 engine's C++ level, bypassing vm2's JavaScript-based exception sanitization. As a result, the attacker's code receives a raw, unsanitized error object from the host environment.
By traversing the constructor chain of this leaked host object (e.g., hostError.constructor.constructor), the attacker can gain access to the host's Function constructor. This allows them to execute arbitrary code outside the sandbox, typically by accessing the process object, leading to a full sandbox escape and remote code execution.
The patch addresses this vulnerability by modifying the sandbox setup process (lib/setup-sandbox.js) to explicitly delete WebAssembly.JSTag from the WebAssembly object within the sandbox, thus closing the loophole.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vm2 | npm | <= 3.10.4 | 3.10.5 |
