Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution
A critical sandbox escape vulnerability in the vm2 Node.js library, tracked as CVE-2026-22709 with a CVSS score of 9.8 out of 10.0, lets attackers bypass Promise.prototype.then and Promise.prototype.catch callback sanitization in version 3.10.0 to escape...