Terrarium sandbox escape allows arbitrary root execution

21 April 2026 routine vulnerability technology

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Prototype chain traversal in Terrarium's Pyodide environment enables unauthenticated sandbox escape and root code execution.

Terrarium, a Node.js-based sandbox for controlled code execution, contains a critical vulnerability (CVE-2026-5752) that allows attackers to escape the sandbox and execute arbitrary commands with root privileges on the host process. The vulnerability stems from improper isolation of JavaScript globals in the Pyodide WebAssembly environment: the mock document object is created as a standard JavaScript object literal inheriting from Object.prototype, enabling attackers to traverse the prototype chain to reach the Function constructor, obtain globalThis, and access Node.js internals including require(). This grants full system access within the container, including ability to read/write sensitive files, access environment variables, and pivot to other network services.

The vendor has released v1.0.1 as a patch and marked it the final release. Organizations unable to patch immediately should disable user-submitted code execution if possible, implement network segmentation to limit lateral movement, monitor container activity, and restrict access to sandboxed execution resources. The attack surface is significant for any application accepting untrusted code for execution in Terrarium.

Mentioned in this report

Vulnerabilities CVE-2026-5752

Detection guidance

Node.js Process Spawning Shell With Reverse Shell or Pipe-to-Shell Patterns

ATT&CK T1059.007

A node process spawning a shell whose command line contains reverse-shell or download-and-execute constructs, as seen after a JavaScript sandbox escape reaches child_process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Process Spawning Shell With Reverse Shell or Pipe-to-Shell Patterns
description: Detects a node process spawning a POSIX shell whose command line holds
  reverse-shell or download-and-execute constructs. After a sandbox escape such as
  the Terrarium prototype-chain bypass (CVE-2026-5752), injected JavaScript can reach
  require('child_process') and run arbitrary commands as the host process user (root).
tags:
- attack.execution
- attack.t1059.007
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /node
    - /nodejs
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  selection_cmd:
    CommandLine|contains:
    - /dev/tcp/
    - mkfifo
    - nc -e
    - ncat -e
    - bash -i
    - '| sh'
    - '| bash'
    - base64 -d
    - base64 --decode
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Node-based build or deployment scripts that pipe a downloaded installer into a shell
- Developer tooling run under node that decodes base64 content in a shell
level: high
id: 2d2d6072-6a79-57a2-883d-bbf7f24a293d
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/414811

Node.js Service Spawning Shell to Read Sensitive Host Files or Credentials

ATT&CK T1059.007

A node process spawning a shell that reads credential files or process environment data, which suggests post-escape reconnaissance from a sandboxed Node.js application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Service Spawning Shell to Read Sensitive Host Files or Credentials
description: Detects a node process spawning a shell that touches credential stores
  or process environment data (/etc/shadow, /proc/self/environ, SSH keys, cloud credential
  files). Matches post-exploitation behaviour after a Node.js sandbox escape where
  attacker JavaScript obtains require() and runs host commands as root.
tags:
- attack.execution
- attack.t1059.007
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /node
    - /nodejs
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  selection_cmd:
    CommandLine|contains:
    - /etc/shadow
    - /proc/self/environ
    - /.ssh/id_
    - /.aws/credentials
    - /var/run/secrets/kubernetes.io
    - /etc/sudoers
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Node-based admin or backup tooling that intentionally reads SSH keys or service
  account tokens through a shell
- Health-check scripts launched by a node supervisor that read Kubernetes service
  account files
level: high
id: 9528cb03-ec78-534a-a554-b4442ebcd729
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/414811

Prototype Chain Traversal to Node.js Internals in Web Request

ATT&CK T1027

A web request carries a constructor.constructor prototype-chain gadget together with Node.js process, require or child_process references, the pattern used in JavaScript sandbox escapes such as the Terrarium bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Prototype Chain Traversal to Node.js Internals in Web Request
description: Detects web requests whose query string combines a constructor.constructor
  Function-constructor gadget with references to Node.js internals (process.mainModule,
  require, child_process). This matches JavaScript sandbox escape payloads like the
  Terrarium prototype-chain bypass (CVE-2026-5752). Only query strings are inspected,
  so POST-body payloads need body logging to be covered.
tags:
- attack.execution
- attack.t1059.007
- attack.stealth
- attack.t1027
logsource:
  category: webserver
detection:
  selection_gadget:
    cs-uri-query|contains:
    - constructor.constructor
    - '[''constructor''][''constructor'']'
    - constructor%2Econstructor
  selection_internals:
    cs-uri-query|contains:
    - process.mainModule
    - require(
    - child_process
    - globalThis
  condition: selection_gadget and selection_internals
falsepositives:
- Security scanners or penetration tests replaying known prototype-pollution and sandbox-escape
  payloads
- Developer documentation or code-playground sites passing JavaScript snippets in
  query strings
level: medium
id: 8fa5cdae-842a-5858-b6b3-82dd090d418d
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/414811

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/414811

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs