vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

Summary: A dozen critical vulnerabilities were disclosed in the vm2 Node.js sandbox library, each allowing sandbox escape and arbitrary code execution on the host system. The flaws were reported by researchers including "XmiliaH" (five CVEs), "c0rydoras" (two), and "0x5t", "bugbunny-research", "hongancalif", and Akshat Sinha, and users are advised to update to version 3.11.2.
Key Takeaway: This follows a CVSS 9.8 sandbox escape patched only a couple of months earlier, and maintainer Patrik Simek has acknowledged new bypasses will likely keep coming - so any product relying on vm2 to isolate untrusted JavaScript carries a recurring escape risk, not a one-time patch.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-22709 CVE-2026-24118 CVE-2026-24120 CVE-2026-24781 CVE-2026-26956 CVE-2026-43997 CVE-2026-43999 CVE-2026-44005 CVE-2026-44006 CVE-2026-44007 CVE-2026-44008 CVE-2026-44009
Related: Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution Cyber Risks ·
⚡ Weekly Recap: Proxy Botnet, Office Zero-Day, MongoDB Ransoms, AI Hijacks & New Threats Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026