vm2 Sandbox Escape via Strict Equality Logic Bypass

CVE-2026-47137 is a critical sandbox escape vulnerability in vm2, a popular Node.js virtualization library used to execute untrusted code in isolated environments. The vulnerability stems from a flawed security check that was intended to prevent dangerous option combinations (nesting: true paired with require: false). However, the check uses strict equality comparison (=== false) rather than loose equality or explicit undefined checking, allowing attackers to bypass the restriction by simply omitting the require option entirely. This affects any application relying on vm2 for code isolation, particularly those executing user-supplied scripts, plugins, or dynamic code. With a CVSS score of 10, this represents complete sandbox escape, enabling arbitrary code execution with the privileges of the Node.js process.

Casky's Claude-powered analysis would detect attack patterns associated with this vulnerability through behavioral monitoring of sandbox breakout attempts and code execution anomalies. While this specific CVE maps to CWE-913 (Improper Control of Dynamically-Managed Code Resources) rather than discrete MITRE ATT&CK techniques, practitioners would identify suspicious indicators including: unusual require() calls originating from supposedly sandboxed contexts, nested VM instantiation patterns that should be blocked, and privilege escalation signals where process-level operations execute from what should be restricted child processes. Security teams using Casky would receive findings highlighting configuration anomalies—specifically instances where vm2 options lack explicit require specifications—and execution flow violations where imported modules or system resources are accessed outside expected isolation boundaries. Extended reasoning capabilities would correlate these signals to confirm sandbox escape exploitation patterns.