{"id":26420,"date":"2026-09-19T00:31:35","date_gmt":"2026-09-18T16:31:35","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93603"},"modified":"2026-09-19T00:31:35","modified_gmt":"2026-09-18T16:31:35","slug":"cve-2026-93603","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93603","title":{"rendered":"CVE-2026-93603 [CRITICAL] &#8211; vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver i"},"content":{"rendered":"<p>vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib\/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function without a receiver \u2014 e.g. `fn()`, a detached method, `fn.call()`, `fn.apply(undefined)`, `Reflect.apply(fn, undefined, [])`, or `fn.bind()()` \u2014 the undefined receiver is passed straight through to the host call, and V8 substitutes the host realm&#8217;s global object for `this`. vm2 then wraps and returns that object to the sandbox, giving sandboxed script a live proxy of the host global. This allows a complete sandbox escape: untrusted script can reach `process` and execute arbitrary code\/commands on the host (for example via `process.getBuiltinModule(&#8216;child_process&#8217;).execSync`). Exploitation requires that the embedding application expose at least one non-strict host function to the sandbox; strict-mode and ES module host functions are not affected.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib\/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-m<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26420","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}