Multiple Critical vm2 Sandbox Escapes Enable Host RCE in Node.js Environments

The vm2 Node.js sandboxing library was hit by a wave of critical sandbox-escape vulnerabilities that let attackers executing untrusted JavaScript break out and run arbitrary commands on the host. Reported flaws include CVE-2026-24120, which bypasses an earlier Promise-species mitigation to reach the host Function constructor; CVE-2026-24118, which abuses __lookupGetter__, Buffer.apply, and prototype traversal; CVE-2026-24781, which leverages inspect proxy unwrapping; CVE-2026-26332, which pivots through SuppressedError; and CVE-2026-26956, which uses WebAssembly JSTag exception handling on Node.js 25+. Across the advisories, affected versions span the 3.10.x branch and earlier, with several issues requiring only the ability to submit code to a vm2 instance and no authentication or user interaction.

The project responded with security releases v3.10.5 and v3.11.0, with v3.11.0 closing 13 advisories including sandbox escapes, denial-of-service bugs, information disclosure, and prototype pollution. Maintainers also patched a separate NodeVM issue tracked as GHSA-m4wx-m65x-ghrr, where enabling nesting: true with omitted or falsy require settings could expose the vm2 package inside the sandbox and lead to host remote code execution. The releases added broader hardening measures such as bufferAllocLimit, stricter handling of dangerous built-ins, and filesystem checks, while maintainers warned that organizations using vm2 to run fully untrusted code should upgrade immediately and avoid treating in-process JavaScript sandboxing as a sole security boundary.