A serious new security vulnerability has shaken the Node.js ecosystem. A critical flaw has been discovered in the popular vm2 library, potentially allowing attackers to escape the sandbox and run arbitrary code on the host system, a nightmare scenario for any platform that executes untrusted code.
The vulnerability, tracked as CVE-2026-22709, carries a CVSS score of 9.8, placing it firmly in the “drop everything and patch now” category. It affects all vm2 versions up to 3.10.0, with the issue fixed in version 3.10.2 and later.
For many developers, vm2 has long been a trusted tool. It’s designed to safely run untrusted JavaScript by isolating it from sensitive resources like the file system, environment variables, and system commands. That’s why it’s widely used in online code editors, SaaS platforms, plugin systems, and environments where user-generated code needs to be contained.
But this trust boundary has now been broken.
What Went Wrong Under the Hood
The root of the problem lies in how vm2 handles JavaScript Promises.
While vm2 carefully sanitizes its own wrapped Promise implementation, it fails to properly sanitize native Promises returned by async functions. This creates a dangerous gap. By crafting malicious .then() or .catch() callbacks, an attacker can bypass vm2’s isolation mechanisms and break out of the sandbox entirely.
Once outside, the attacker gains access to the full Node.js environment, meaning they could load modules like child_process, execute system commands, and effectively take control of the underlying server.
Why This Is So Dangerous
This isn’t just a theoretical risk. Any platform that allows users to submit and run code, from developer tools to learning platforms to enterprise SaaS products, could be exposed. Even worse, sandbox escapes don’t always trigger obvious crashes or alerts, meaning attackers could quietly maintain access without being noticed.
A Familiar Pattern
Unfortunately, this isn’t vm2’s first serious security failure. The library has suffered multiple critical sandbox escape vulnerabilities over the past few years, leading many in the security community to question whether application-level sandboxing alone is truly reliable.
What Developers Should Do Now
If you’re using vm2, the advice is clear: Update immediately to version 3.10.2 or later.
Security experts are also urging teams to consider stronger isolation approaches such as isolated-vm, which relies on native V8 isolates, and to layer protections using OS-level isolation like containers or virtual machines.
Because if this vulnerability proves anything, it’s this: Sandboxing is fragile, and real security requires defense in depth.
Caught feelings for cybersecurity? It’s okay, it happens. Follow us on LinkedIn, Youtube and Instagram to keep the spark alive.
