Loading story…
A critical sandbox-escape vulnerability in the popular Node.js sandbox library vm2 allows attackers to bypass isolation and execute arbitrary code on the host. Tracked as CVE-2026-22709 (CVSS v3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the issue stems from incomplete sanitization of Promise.prototype.then/Promise.prototype.catch callbacks in lib/setup-sandbox.js: local promise callbacks are sanitized, but global promise callbacks are not, and async functions return a globalPromise object that can be abused to reach unsanitized paths.
Public technical details describe an exploitation chain where an attacker leverages the unsanitized global promise catch behavior to obtain an error object’s constructor, traverse the prototype chain to the Function constructor, and then execute code outside the sandbox (including loading Node modules such as child_process to run system commands). The vulnerability affects vm2 versions prior to 3.10.2 (with some reporting noting exposure through 3.10.0 and below), and vm2 3.10.2 is identified as the fix; organizations running untrusted code via vm2 should prioritize upgrading and review any services that rely on vm2 for isolation.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
After disclosure and the 3.10.2 fix, reporting highlighted vm2 3.10.3 as the latest recommended release, with claims it includes additional or all disclosed sandbox-escape fixes. Users were advised to upgrade beyond vulnerable versions immediately.
Subsequent reporting published exploit details showing how attackers could abuse unsanitized global Promise behavior, traverse to the Function constructor, and execute host commands such as via child_process.execSync. Multiple sources described proof-of-concept exploit chains and working demonstrations.
The vulnerability was publicly disclosed as CVE-2026-22709, affecting vm2 and allowing attackers to escape the Node.js sandbox and execute arbitrary code on the host. Reports describe the root cause as incomplete sanitization of Promise.prototype.then and Promise.prototype.catch when async functions return global Promise objects.
The vm2 maintainers released version 3.10.2 to fully address CVE-2026-22709, a sandbox escape caused by improper sanitization of Promise callback handling. The fix covers affected versions prior to 3.10.2 and is referenced by the release tag, fixing commit, and GitHub Security Advisory.
A partial mitigation for the vm2 sandbox escape vulnerability was released in version 3.10.1, but the issue was not fully resolved. Later reporting states the flaw remained exploitable until a subsequent release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcecsoonline.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical sandbox-escape flaw in the Node.js library **vm2** allows attackers to bypass protections around `Promise.prototype.then` and `Promise.prototype.catch`, break out of the sandbox, and execute arbitrary code on the host. The vulnerability, tracked as **`CVE-2026-22709`** with a **CVSS 9.8** score, affects **vm2 3.10.0 and earlier** and strikes at the library’s core purpose of safely running untrusted JavaScript. Users were urged to upgrade immediately to **`vm2` 3.10.2** or later. The disclosure follows broader concerns about vm2’s long-term viability after repeated sandbox escapes and a prior GitHub advisory describing additional flaws that could lead to remote code execution. Semgrep reported that the project was later discontinued after maintainers concluded vm2’s dependence on Node’s `vm` module and JavaScript proxy behavior made the sandboxing model fundamentally difficult to secure. The maintainer recommended **isolated-vm** as an alternative, while warning signs around maintenance and ecosystem support continue to raise risk for organizations that rely on JavaScript sandboxing libraries.
Jul 24, 2026
The `vm2` Node.js sandboxing library was hit by a wave of critical sandbox-escape vulnerabilities that let attackers executing untrusted JavaScript break out and run arbitrary commands on the host. Reported flaws include CVE-2026-24120, which bypasses an earlier Promise-species mitigation to reach the host `Function` constructor; CVE-2026-24118, which abuses `__lookupGetter__`, `Buffer.apply`, and prototype traversal; CVE-2026-24781, which leverages `inspect` proxy unwrapping; CVE-2026-26332, which pivots through `SuppressedError`; and CVE-2026-26956, which uses WebAssembly `JSTag` exception handling on Node.js 25+. Across the advisories, affected versions span the `3.10.x` branch and earlier, with several issues requiring only the ability to submit code to a vm2 instance and no authentication or user interaction. The project responded with security releases `v3.10.5` and `v3.11.0`, with `v3.11.0` closing 13 advisories including sandbox escapes, denial-of-service bugs, information disclosure, and prototype pollution. Maintainers also patched a separate `NodeVM` issue tracked as `GHSA-m4wx-m65x-ghrr`, where enabling `nesting: true` with omitted or falsy `require` settings could expose the `vm2` package inside the sandbox and lead to host remote code execution. The releases added broader hardening measures such as `bufferAllocLimit`, stricter handling of dangerous built-ins, and filesystem checks, while maintainers warned that organizations using vm2 to run fully untrusted code should upgrade immediately and avoid treating in-process JavaScript sandboxing as a sole security boundary.
Jun 29, 2026
A wave of disclosures has exposed multiple critical flaws in the Node.js sandbox library **vm2**, showing that untrusted JavaScript can break out of the sandbox and execute commands on the host. GitHub advisories describe several distinct escape paths affecting versions as old as `3.9.6` and, in some cases, up to `3.11.3`, including a breakout through Node.js `inspect`, a Promise species bypass that defeats an earlier patch, prototype pollution through vm2’s bridge to host intrinsic prototypes, and a `NodeVM` misconfiguration path where `nesting: true` lets code bypass `require: false` and load `vm2` recursively to reach modules such as `child_process`. Public proof-of-concepts show attackers recovering the host `process` object and invoking host commands, turning vm2 from a containment boundary into a route to full host compromise. Additional reporting and upstream changes indicate the problems are broader than a single bug. Semgrep documented a new sandbox escape, while vm2 maintainers added regression tests covering descriptor- and prototype-traversal techniques used to recover host constructors such as `Function`, `AsyncFunction`, and `GeneratorFunction`, as well as callback sanitization bypasses tied to Promise handling. A later roundup described five critical vulnerabilities with no practical configuration-based workaround for deployments that execute untrusted code, and urged upgrades to **vm2 `3.11.4` or later**. The advisory backlog on the project’s GitHub page shows a concentrated set of newly published sandbox escape, builtin bypass, and host code execution issues, underscoring that organizations relying on vm2 for isolation should treat affected environments as potentially compromised.
Jun 29, 2026