CVE-2026-47209— Patrik Simek vm2 处理逻辑错误漏洞

vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unconditionally writes to the host target object. Per the Proxy set trap specification, when receiver !== proxy (e.g., when a child object inherits from the proxy via Object.create), the property assignment should create an own property on the receiver, not on the proxy target. The current implementation always calls otherReflectSet(object, key, value) against the host target, causing all inherited property writes to leak through to the host object. This bug provides an alternative attack vector for writing dangerous cross-realm Symbol keys (e.g., nodejs.util.promisify.custom) to host objects, bypassing any future per-trap isDangerousCrossRealmSymbol guard on the direct set path. This issue has been patched in version 3.11.4.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

保护机制失效

Patrik Simek vm2 处理逻辑错误漏洞

patriksimek vm2是patriksimek的沙箱。 Patrik Simek vm2 3.11.4之前版本存在处理逻辑错误漏洞，该漏洞源于BaseHandler.set trap忽略receiver参数并无条件写入主机目标对象，可能导致攻击者通过继承属性写入将危险的跨域Symbol键写入主机对象。

N/A

N/A