CVE-2026-47210: 
JavaScript 취약성 분석 및 완화

CVE-2026-47210 is a critical sandbox escape vulnerability in vm2, an open-source Node.js VM/sandbox library, that allows arbitrary code execution in the host process. It affects all versions up to and including 3.11.3 (i.e., < 3.11.4) and was first published by the maintainer on May 18, 2026, with the GitHub Advisory Database entry published May 29, 2026 and NVD publication on June 12, 2026. The vulnerability is classified as Critical with a CVSS v3.1 base score of 9.8 (Github Advisory, GitHub Security Advisory). The issue was reported by security researcher RealHurrison (Github Advisory).

The root cause is classified as CWE-913 (Improper Control of Dynamically-Managed Code Resources). The vulnerability arises because WebAssembly.promising() in Node.js 26+ (and Node 24 with --experimental-wasm-jspi) returns Promise objects whose [[Prototype]] chain points directly at the host realm's Promise.prototype without any bridge proxy interposition — bypassing vm2's sandbox-side Promise overrides and resetPromiseSpecies hardening (GitHub Security Advisory, Patch Commit). An attacker installs a custom constructor getter on the JSPI-backed Promise, causing p.finally() to invoke host Promise.prototype.finally; V8's SpeciesConstructor then reads the attacker-controlled class F, and the eventual host-realm TypeError rejection is dispatched through F's reject closure with no bridge mediation, allowing e.constructor.constructor('return process')() to evaluate in the host realm (GitHub Security Advisory). A public proof-of-concept is included in the advisory and requires only that the target application uses vm2 with async support on a Node.js runtime exposing WebAssembly JSPI (Node 26+ by default) (Github Advisory).

Successful exploitation results in complete compromise of the host process: an attacker can execute arbitrary operating system commands, read and write arbitrary files accessible to the host process, and steal secrets, tokens, credentials, and application data (GitHub Security Advisory). Any application that relies on vm2 as a security boundary — such as code execution platforms, online IDEs, or multi-tenant SaaS services — is fully compromised, with high confidentiality, integrity, and availability impact. The attack requires no authentication and no user interaction, making it particularly severe for internet-facing services that accept and execute user-supplied JavaScript (Github Advisory).

1. Identify target: Locate an application that uses vm2 (npm package) as a sandbox for executing untrusted JavaScript, running on Node.js 26+ (where WebAssembly JSPI is enabled by default) or Node.js 24 with --experimental-wasm-jspi.
2. Craft malicious WebAssembly module: Prepare a minimal WASM binary that imports a JS function wrapped with WebAssembly.Suspending, causing a host-realm TypeError during JSPI processing.
3. Instantiate WASM and obtain JSPI Promise: Inside the vm2 sandbox, call WebAssembly.instantiate(wasmBytes, {m:{f: new WebAssembly.Suspending(...)}}), then invoke the exported function via WebAssembly.promising(r.instance.exports.run)() to obtain a JSPI-backed Promise p whose [[Prototype]] is the host realm's Promise.prototype.
4. Install attacker-controlled species: Define a custom class F with a constructor that captures the reject callback. Set Object.defineProperty(F, Symbol.species, {get(){return F}}) and Object.defineProperty(p, 'constructor', {get(){return F}}) to redirect V8's SpeciesConstructor lookup to F.
5. Trigger .finally() to reach host realm: Call p.finally(()=>{}). This invokes host Promise.prototype.finally, which uses SpeciesConstructor to call new F(...), storing sandbox closures as raw [[Resolve]]/[[Reject]] with no bridge mediation.
6. Execute arbitrary code in host: When the host-realm TypeError rejection is dispatched to F's reject closure, use e.constructor.constructor('return process')() to obtain the host process object, then call process.mainModule.require('child_process').execSync('<command>') to execute arbitrary OS commands (GitHub Security Advisory, Patch Commit).

• Process: Unexpected child processes spawned by the Node.js process running vm2 (e.g., sh, bash, cmd.exe, or other shells); calls to execSync, exec, or spawn originating from within a vm2 sandbox context.
• File System: Unexpected files created or modified by the Node.js service account (e.g., a pwned file as demonstrated in the PoC); new scripts, binaries, or cron jobs written by the application process.
• Logs: Application logs showing WebAssembly instantiation or WebAssembly.promising/WebAssembly.Suspending usage within sandboxed code; Node.js unhandled rejection or TypeError stack traces involving Promise.prototype.finally and cross-realm constructor chains.
• Network: Unexpected outbound connections from the Node.js host process to external IPs (indicative of reverse shell or data exfiltration following sandbox escape) (GitHub Security Advisory).

Upgrade vm2 to version 3.11.4 or later, which removes WebAssembly.promising and WebAssembly.Suspending from the sandbox at bootstrap, eliminating the JSPI attack surface (vm2 Release, Patch Commit). As a temporary workaround prior to patching, disable async support and WebAssembly JSPI in the runtime (avoid Node.js 26+ or use --no-experimental-wasm-jspi on Node 24), or avoid executing untrusted code in vm2 entirely until the patch is applied. Applications relying on vm2 as a security boundary in high-risk environments should evaluate alternative sandboxing solutions given vm2's history of sandbox escapes (Github Advisory).

The vulnerability received coverage from Heise Online, which reported on four critical security gaps with maximum ratings closed in vm2 (Heise). Security news aggregator SecurityOnline.info also covered the vm2 sandbox escape vulnerabilities in the context of Node.js RCE risks. The broader security community noted that vm2 has a long history of sandbox escapes, reinforcing concerns about using it as a hard security boundary in production environments.