Critical sandbox escape in the vm2 Node.js library

A critical vulnerability, CVE-2026-22709, has been found in the vm2 JavaScript sandbox library. It allows an attacker to escape the sandbox and execute arbitrary code on the underlying host. The flaw stems from improper sanitisation of asynchronous Promise callbacks, letting malicious code running inside vm2 break isolation and run commands on the host system. vm2 remains widely used in SaaS platforms, code runners, chatbots and other environments that execute untrusted JavaScript, with around one million weekly downloads on npm.

What this means for your organisation

vm2 is rarely something anyone chose deliberately. It sits as a dependency a couple of levels down inside a platform someone bought or built. If it is in use where customers or users can supply code, expressions or templates, the isolation you believed you had is no longer there. It is also a reminder that in-process sandboxes are a weaker guarantee than many risk assessments assume.

Berigo recommends

• Search for vm2 across the full dependency tree of your applications, not just direct dependencies.
• Ask vendors of platforms that run user-supplied code whether they use vm2, and get the answer in writing.
• Move execution of untrusted code to OS- or container-level isolation rather than relying on an in-process sandbox.
• Introduce automated dependency scanning in your build pipeline if you do not already have it.

Source

• bleepingcomputer.com
• cve.org
• github.com