Critical Sandbox Vulnerability in Popular vm2 Library Allows Arbitrary Code Execution

Key Findings

• A critical sandbox escape vulnerability has been disclosed in the popular vm2 Node.js library, tracked as CVE-2026-22709.

• The vulnerability carries a CVSS score of 9.8 out of 10.0, indicating its high severity.

• The flaw allows attackers to escape the sandbox environment and execute arbitrary code on the underlying operating system.

Background

• vm2 is a Node.js library used to run untrusted code within a secure sandboxed environment.

• The library intercepts and proxies JavaScript objects to prevent sandboxed code from accessing the host environment.

• The newly discovered flaw stems from the library's improper sanitization of Promise handlers, creating an escape vector.

Vulnerability Details

• The critical insight is that async functions in JavaScript return `globalPromise` objects, not `localPromise` objects.

• Since `globalPromise.prototype.then` and `globalPromise.prototype.catch` are not properly sanitized (unlike `localPromise`), this creates an opportunity for attackers to bypass the sandbox.

Impact and Exploitation

• Successful exploitation of CVE-2026-22709 would allow attackers to execute arbitrary code outside the sandbox boundaries.

• This could grant them the same level of access as the vm2 application, potentially exposing sensitive data, modifying critical systems, and performing other malicious actions.

Mitigation and Recommendations

• The vulnerability has been addressed in vm2 version 3.10.2, and users are advised to update their installations immediately.

• However, the maintainers have acknowledged that new bypasses are likely to be discovered in the future, urging users to keep the library up to date and consider more robust alternatives, such as isolated-vm, for stronger isolation guarantees.

Conclusion

The discovery of CVE-2026-22709 highlights the ongoing challenges in securing sandbox environments, particularly in the context of complex and widely-used libraries like vm2. Users are encouraged to remain vigilant, keep their systems updated, and explore alternative solutions that provide more robust isolation guarantees.

Sources

• https://thehackernews.com/2026/01/critical-vm2-nodejs-flaw-allows-sandbox.html

• https://securityonline.info/sandbox-shattered-critical-n8n-flaw-cvss-9-9-allows-remote-code-execution/

• https://www.bleepingcomputer.com/news/security/critical-sandbox-escape-flaw-discovered-in-popular-vm2-nodejs-library/

• https://fridaysecurity.org/news/critical-sandbox-escape-flaw-discovered-in-popular-vm2-nodejs-library

• https://www.reddit.com/r/pwnhub/comments/1qp3v5e/critical_sandbox_escape_flaw_discovered_in/

• https://www.linkedin.com/pulse/critical-vm2-sandbox-vulnerability-nodejs-lets-attackers-2iogc