CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93603

vm2 (Node.js sandbox library) through 3.12.0 is vulnerable to a complete sandbox escape due to incorrect handling of a nullish this receiver in the apply trap of its bridge (lib/bridge.js). When sandboxed code invokes a host-provided non-strict (sloppy-mode) function without a receiver (e.g., fn(...

CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...