CVE-2026-93606: vm2 before 3.12.1 sandbox escape via host-realm Promise Symbol.species VM and NodeVM

• Affected versions: ≤ 3.12.0 (all prior lines; the vulnerability is in the bridge's promise-rejection sanitizer introduced with the m283 defenses)
• Patched version: 3.12.1 (also current latest 3.12.2)
• Risk: Critical (CVSS v4 10.0, GHSA-6454-5x88-m6jw). Any embedder that hands the sandbox a Promise-returning host API (caching layers, RPC stubs, fetch-like wrappers) exposes full host RCE: filesystem, child_process, env vars, outbound network.

Impact Parity

• Disclosed/claimed maximum impact: sandbox escape → host arbitrary code execution.
• Reproduced impact from this run: full sandbox escape with host command execution. From inside both VM and NodeVM, the sandboxed script (a) received the raw host process object as a live bridge proxy (isProxy: true), (b) read a host-only environment variable (HOST_ONLY_SECRET=CANARY123) invisible to the sandbox's own process stub, and (c) executed host shell commands via hostValue.mainModule.require('child_process').execSync, writing unique per-attempt marker files on the host filesystem.
• Parity: full.

Root Cause

Two defense gaps compose:

1. Species neutralization is sandbox-realm-only. lib/setup-sandbox.js overrides then/catch/finally on the sandbox intrinsic Promise.prototype to call resetPromiseSpecies(this) (GHSA-27g9-p43v-cw3v). A host Promise crossing the bridge keeps the host Promise.prototype methods, so this neutralization never runs for it. Meanwhile BaseHandler.set deliberately allows ordinary sandbox writes onto a non-frozen host object, so p.constructor = { [Symbol.species]: Evil } lands on the raw host promise.

2. The rejection sanitizer only wraps function-valued slots. The bridge's apply-trap interception of host Promise.prototype.then/catch (normalizeHostPromiseCallbacks / makeSanitizedPromiseCallback in lib/bridge.js) wraps onFulfilled/onRejected only when the slot holds a function. Per PerformPromiseThen, a missing/non-callable onRejected makes V8 substitute its internal Thrower, which performs throw reason into resultCapability.[[Reject]] with the raw host value. Because resultCapability was built via SpeciesConstructor(p, %Promise%) → new Evil(GetCapabilitiesExecutor) — executed back in the sandbox through the proxy's [[Construct]] trap — [[Reject]] is an attacker sandbox closure. No handleException, ensureThis, or hostPromiseSanitizeReject chokepoint exists on this path.

Fix (vm2 3.12.1, GHSA-6454-5x88-m6jw): peelEffectivePromiseCall now returns the effective receiver of host then/catch/finally (also unwinding Reflect.apply), and neutralizeHostPromiseSpeciesOn installs constructor = undefined as an own data property on the raw host promise for the duration of the call, forcing SpeciesConstructor to fall back to the realm-correct host %Promise%. The reaction capability is then a genuine host promise; the raw settlement can only be observed by attaching a fresh .then/.catch, which re-enters the sanitizer. Verified: on 3.12.1 the sandbox script's hijack closure is never invoked (sandbox returned: UNSET) and no host marker file is created.

Reproduction Steps

1. bundle/repro/reproduction_steps.sh (self-contained; run twice consecutively — both runs exit 0).
2. The script downloads the immutable npm tarballs vm2@3.12.0 (vulnerable) and vm2@3.12.1 (fixed), installs them with pinned integrity into the prepared project cache (/pruva/project-cache/vm2-pkgs, fallback bundle/artifacts/vm2-pkgs), generates bundle/repro/harness.js, and runs two clean attempts per build per sandbox class (VM ×2, NodeVM ×2 on each version) via node harness.js <vm2-dir> <VM|NodeVM> <id>, each invocation bounded by timeout 60.
3. Expected evidence: every vulnerable attempt prints ESCAPE_CONFIRMED with {"isProxy":true,"envSecret":"CANARY123","exec":"PWNED_FROM_SANDBOX","markerWritten":true} and creates a host-side marker file repro/proof/marker-vulnerable-<mode>-<n>.txt containing the unique attempt token; every fixed attempt prints ESCAPE_NOT_CONFIRMED (sandbox returned: UNSET) and creates no marker.

Evidence

• Per-attempt logs: bundle/repro/proof/{vulnerable,fixed}-{VM,NodeVM}-{1,2}.log
• Host-written marker files (proof of host command execution from the sandbox): bundle/repro/proof/marker-vulnerable-VM-{1,2}.txt, bundle/repro/proof/marker-vulnerable-NodeVM-{1,2}.txt
• Exploit harness executed: bundle/repro/harness.js
• Diagnostics: bundle/logs/reproduction_steps.log
• Machine-readable manifest with sha256 of every proof artifact and npm-tarball-bound target identity: bundle/repro/runtime_manifest.json
• Key excerpt (vulnerable, VM): [VM:vulnerable-1] sandbox returned: {"isProxy":true,"envSecret":"CANARY123","exec":"PWNED_FROM_SANDBOX","markerWritten":true} → ESCAPE_CONFIRMED
• Key excerpt (fixed, VM): [VM:fixed-1] sandbox returned: UNSET → ESCAPE_NOT_CONFIRMED
• Environment: Node.js v24.18.0, linux x86_64; vm2@3.12.0 tarball sha256 263d59bfcdd5107915551b4181228fb5c8dd98f043faa78f2b8fb33f8fe8ffa8; vm2@3.12.1 tarball sha256 afa9d765ff89edcd8472ef2fb3e1707d2e9077aeffe8ea861fd46aa696726513.

Recommendations / Next Steps

• Upgrade to vm2 ≥ 3.12.1 immediately; note vm2 is formally discontinued upstream, so prefer migrating to isolated-vm or Node's vm with out-of-process isolation for any untrusted-code workload.
• The 3.12.1 fix (species neutralization at the SpeciesConstructor chokepoint + Reflect.apply peel) is the correct layered defense; regression tests should cover .then(), .catch(), .finally(), Function.prototype.call/apply, and Reflect.apply indirection against host promises.
• Embedders should additionally avoid returning host promises that reject with host-pivotable values, and should freeze exposed host objects where feasible.

Additional Notes

• Idempotent: the script reuses the cached package installs keyed by version, removes stale markers before each attempt, and was run twice consecutively with identical confirmed results.
• The PoC mechanics were reconstructed from the vendor advisory GHSA-6454-5x88-m6jw and independently re-executed against the published npm artifacts in this run; no historical proof was reused.
• Limitations: the escape requires an embedder-exposed host function returning a host-realm Promise (the documented vm2 pattern) and a rejection path; impact is unconditional once those hold, independent of what the promise rejects with.