# Terrarium sandbox escape allows arbitrary root execution

Published: 2026-04-21 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/b15d02e4-91d8-5096-b7d4-9655b64b2350/terrarium-sandbox-escape-allows-arbitrary-root-execution

> Prototype chain traversal in Terrarium's Pyodide environment enables unauthenticated sandbox escape and root code execution.

Terrarium, a Node.js-based sandbox for controlled code execution, contains a critical vulnerability (CVE-2026-5752) that allows attackers to escape the sandbox and execute arbitrary commands with root privileges on the host process. The vulnerability stems from improper isolation of JavaScript globals in the Pyodide WebAssembly environment: the mock document object is created as a standard JavaScript object literal inheriting from Object.prototype, enabling attackers to traverse the prototype chain to reach the Function constructor, obtain globalThis, and access Node.js internals including require(). This grants full system access within the container, including ability to read/write sensitive files, access environment variables, and pivot to other network services.

The vendor has released v1.0.1 as a patch and marked it the final release. Organizations unable to patch immediately should disable user-submitted code execution if possible, implement network segmentation to limit lateral movement, monitor container activity, and restrict access to sandboxed execution resources. The attack surface is significant for any application accepting untrusted code for execution in Terrarium.

## Mentioned in this report

- Vulnerabilities: CVE-2026-5752

## Detection guidance (public sample)

### Node.js Process Spawning Shell With Reverse Shell or Pipe-to-Shell Patterns

ATT&CK: T1059.007

A node process spawning a shell whose command line contains reverse-shell or download-and-execute constructs, as seen after a JavaScript sandbox escape reaches child_process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Node.js Process Spawning Shell With Reverse Shell or Pipe-to-Shell Patterns
description: Detects a node process spawning a POSIX shell whose command line holds
  reverse-shell or download-and-execute constructs. After a sandbox escape such as
  the Terrarium prototype-chain bypass (CVE-2026-5752), injected JavaScript can reach
  require('child_process') and run arbitrary commands as the host process user (root).
tags:
- attack.execution
- attack.t1059.007
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /node
    - /nodejs
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  selection_cmd:
    CommandLine|contains:
    - /dev/tcp/
    - mkfifo
    - nc -e
    - ncat -e
    - bash -i
    - '| sh'
    - '| bash'
    - base64 -d
    - base64 --decode
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Node-based build or deployment scripts that pipe a downloaded installer into a shell
- Developer tooling run under node that decodes base64 content in a shell
level: high
id: 2d2d6072-6a79-57a2-883d-bbf7f24a293d
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/414811
```

### Node.js Service Spawning Shell to Read Sensitive Host Files or Credentials

ATT&CK: T1059.007

A node process spawning a shell that reads credential files or process environment data, which suggests post-escape reconnaissance from a sandboxed Node.js application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Node.js Service Spawning Shell to Read Sensitive Host Files or Credentials
description: Detects a node process spawning a shell that touches credential stores
  or process environment data (/etc/shadow, /proc/self/environ, SSH keys, cloud credential
  files). Matches post-exploitation behaviour after a Node.js sandbox escape where
  attacker JavaScript obtains require() and runs host commands as root.
tags:
- attack.execution
- attack.t1059.007
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /node
    - /nodejs
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  selection_cmd:
    CommandLine|contains:
    - /etc/shadow
    - /proc/self/environ
    - /.ssh/id_
    - /.aws/credentials
    - /var/run/secrets/kubernetes.io
    - /etc/sudoers
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Node-based admin or backup tooling that intentionally reads SSH keys or service
  account tokens through a shell
- Health-check scripts launched by a node supervisor that read Kubernetes service
  account files
level: high
id: 9528cb03-ec78-534a-a554-b4442ebcd729
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/414811
```

### Prototype Chain Traversal to Node.js Internals in Web Request

ATT&CK: T1027

A web request carries a constructor.constructor prototype-chain gadget together with Node.js process, require or child_process references, the pattern used in JavaScript sandbox escapes such as the Terrarium bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Prototype Chain Traversal to Node.js Internals in Web Request
description: Detects web requests whose query string combines a constructor.constructor
  Function-constructor gadget with references to Node.js internals (process.mainModule,
  require, child_process). This matches JavaScript sandbox escape payloads like the
  Terrarium prototype-chain bypass (CVE-2026-5752). Only query strings are inspected,
  so POST-body payloads need body logging to be covered.
tags:
- attack.execution
- attack.t1059.007
- attack.stealth
- attack.t1027
logsource:
  category: webserver
detection:
  selection_gadget:
    cs-uri-query|contains:
    - constructor.constructor
    - '[''constructor''][''constructor'']'
    - constructor%2Econstructor
  selection_internals:
    cs-uri-query|contains:
    - process.mainModule
    - require(
    - child_process
    - globalThis
  condition: selection_gadget and selection_internals
falsepositives:
- Security scanners or penetration tests replaying known prototype-pollution and sandbox-escape
  payloads
- Developer documentation or code-playground sites passing JavaScript snippets in
  query strings
level: medium
id: 8fa5cdae-842a-5858-b6b3-82dd090d418d
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/414811
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/414811

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b15d02e4-91d8-5096-b7d4-9655b64b2350/terrarium-sandbox-escape-allows-arbitrary-root-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup