Critical vm2 Sandbox Escape Enables Arbitrary Code Execution in Node.js

A critical sandbox-escape flaw in the Node.js library vm2 allows attackers to bypass protections around Promise.prototype.then and Promise.prototype.catch, break out of the sandbox, and execute arbitrary code on the host. The vulnerability, tracked as CVE-2026-22709 with a CVSS 9.8 score, affects vm2 3.10.0 and earlier and strikes at the library’s core purpose of safely running untrusted JavaScript. Users were urged to upgrade immediately to vm2 3.10.2 or later.

The disclosure follows broader concerns about vm2’s long-term viability after repeated sandbox escapes and a prior GitHub advisory describing additional flaws that could lead to remote code execution. Semgrep reported that the project was later discontinued after maintainers concluded vm2’s dependence on Node’s vm module and JavaScript proxy behavior made the sandboxing model fundamentally difficult to secure. The maintainer recommended isolated-vm as an alternative, while warning signs around maintenance and ecosystem support continue to raise risk for organizations that rely on JavaScript sandboxing libraries.