CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of Apps

A critical security vulnerability has been unearthed in vm2, a highly popular sandbox library for Node.js used by millions of developers to run untrusted code. Tracked as CVE-2026-22709, the flaw carries a maximum CVSS severity score of 9.8, allowing attackers to completely bypass the sandbox environment and execute arbitrary code on the host machine.

The vulnerability affects vm2 versions 3.10.0 and below, posing a severe risk to any application relying on it for isolation.

The core of the issue lies in how the sandbox handles JavaScript Promises—specifically, the sanitization of callback functions. While vm2 was designed to sanitize the callbacks of the local Promise.prototype.then and Promise.prototype.catch, researchers discovered a blind spot: the globalPromise.

“In lib/setup-sandbox.js, the callback function of local Promise.prototype.then is sanitized, but globalPromise.prototype.then is not sanitized,” the advisory explains.

This oversight becomes exploitable because “the return value of async functions is [a] globalPromise object”. By simply defining an async function, an attacker can obtain a reference to this unsanitized Promise object and use it to break out of the cage.

By leveraging the unsanitized catch method on the global Promise, an attacker can access the constructor of an error object. From there, they can walk up the prototype chain to access the Function constructor, which allows them to generate new code outside the sandbox’s restrictions.

The exploit code provided in the disclosure demonstrates how an attacker can use this chain to load the child_process module and execute system commands, such as execSync(‘echo HELLO WORLD!’).

Given the popularity of vm2—which sees over 3.7 million downloads every month—the potential blast radius of this vulnerability is immense.

Maintainers have released a patch to close this loophole. Users are urged to upgrade to vm2 version 3.10.2 immediately to ensure their sandboxes remain secure.

Related Posts:

• CVE-2023-29199: Critical Sandbox Escape Vulnerability in VM2 library
• CVE-2023-37466: Critical Sandbox Escape Vulnerabilities in VM2 Library
• Exploit available for critical RCE (CVE-2023-32314) bug in VM2 sandbox library
• CVE-2023-30547: Critical Security Flaw in Popular JavaScript Sandbox Module vm2