Critical vm2 Sandbox Escapes Expose Node.js Hosts to Arbitrary Code Execution

Researchers disclosed a broad set of critical flaws in the vm2 Node.js sandbox library that allow untrusted JavaScript to break isolation and execute arbitrary code on the host system. Reports describe 11 to 12 vulnerabilities affecting versions across the 3.9.6 to 3.11.1 range, with most rated CVSS 9.8 to 10.0, and impacting core protections such as built-in allowlists, object handling, prototype traversal, Promise species behavior, util.inspect, Module._load(), WebAssembly exception handling, and unsafe nesting: true configurations. One tracked issue, CVE-2026-24118, is a sandbox breakout through __lookupGetter__ in versions prior to 3.11.0, enabling host-level command execution with no privileges or user interaction.

The disclosures reinforce long-running concerns that vm2's JavaScript-only isolation model is not dependable for high-risk use cases such as multi-tenant code execution, plugin evaluation, automated grading, and serverless workloads. While some reports recommend upgrading to vm2 3.11.2 for the latest protections, others note that CVE-2026-44008 and CVE-2026-44009 remain unpatched and argue that organizations handling untrusted code should consider stronger isolation boundaries such as containers or microVMs. Successful exploitation could expose environment variables, credentials, and files, and enable full compromise of the underlying Node.js host and potential lateral movement.