george0papasotiriou/cve-2026-11114-node.js-vm-sandbox-escape-via-proxyPoC exploit for CVE-2026-11114 demonstrating Node.js vm sandbox escape via Proxy to achieve remote code execution against a vulnerable HTTP /eval endpoint.
vm Sandbox Escape via Proxy// sandbox_server.js - Vulnerable VM sandbox
const vm = require('vm');
const express = require('express');
const app = express();
app.use(express.json());
app.post('/eval', (req, res) => {
const code = req.body.code;
const sandbox = { console: { log: () => {} } }; // limited sandbox
const script = new vm.Script(code);
const context = vm.createContext(sandbox);
try {
const result = script.runInContext(context);
res.send(String(result));
} catch(e) {
res.send(e.message);
}
});
app.listen(3000);
vmAn application uses Node.js’s vm module to execute user code in a sandbox, but fails to properly isolate the global object. An attacker can access the constructor chain (e.g., via this.constructor.constructor) to escape the sandbox and execute arbitrary shell commands.
vm context still provides access to built‑in constructors that grant access to the Node.js global scope (process).npm install express
node sandbox_server.js
python exploit_vm_escape.py
The output shows the result of id, proving command execution.