Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution
Summary: A critical sandbox escape vulnerability in the vm2 Node.js library, tracked as CVE-2026-22709 with a CVSS score of 9.8 out of 10.0, lets attackers bypass Promise.prototype.then and Promise.prototype.catch callback sanitization in version 3.10.0 to escape the sandbox and run arbitrary code on the underlying operating system. The flaw was addressed in vm2 3.10.2, and users are recommended to update to 3.10.3, which adds fixes for additional sandbox escapes.
What's compelling: This is the latest in a steady stream of vm2 sandbox escapes - CVE-2022-36067, CVE-2023-29017, CVE-2023-29199, CVE-2023-30547, CVE-2023-32314, CVE-2023-37466, and CVE-2023-37903 - and the maintainer has acknowledged new bypasses will likely be discovered in the future, so any code still relying on vm2 for isolation carries a recurring exposure.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-36067CVE-2023-29017CVE-2023-29199CVE-2023-30547CVE-2023-32314CVE-2023-37466CVE-2023-37903CVE-2026-22709
- Related
- vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution Cyber Risks ·⚡ Weekly Recap: Proxy Botnet, Office Zero-Day, MongoDB Ransoms, AI Hijacks & New Threats Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026