Critical vm2 Flaw Lets Attackers Bypass Sandbox and Execute Arbitrary Code in Node.js
A critical vulnerability has been identified in the vm2 JavaScript sandbox library (versions ≤ 3.10.0), allowing attackers to bypass sandbox protections and execute arbitrary code with full system privileges.
A critical vulnerability has been identified in the vm2 JavaScript sandbox library (versions ≤ 3.10.0), allowing attackers to bypass sandbox protections and execute arbitrary code with full system privileges.
The vm2 library is deployed across 273,000 projects on npm and is designed to safely execute untrusted code in isolated environments. However, the vulnerability undermines this security by exploiting improper sanitization of Promise callback functions, allowing remote code execution without authentication or user interaction.
Property Value
CVE ID CVE-2026-22709
Advisory GHSA-99p7-6v5w-7xg8
Package vm2 (npm)
The vm2 library is deployed across 273,000 projects on npm and is designed to safely execute untrusted code in isolated environments.
Affected Versions ≤ 3.10.0
Patched Version 3.10.2
Type Sandbox Escape
CVSS Score 9.8 / 10
The flaw allows attackers to leverage async function return values to access unsanitized Promise.prototype.then callbacks, bypassing the intended sanitization layer implemented in lib/setup-sandbox.js. This results from inconsistent callback sanitization across Promise implementations. While localPromise.prototype.then callbacks receive proper sanitization checks, the globalPromise object returned by async functions bypasses these protections.
Attackers exploit this inconsistency by constructing error objects with Symbol properties that trigger async function execution, exposing the unsanitized globalPromise.prototype.then method. Successful exploitation grants attackers direct access to the Error constructor’s Function prototype, enabling arbitrary code execution through child_process module invocation or direct system command execution.
The critical severity of this vulnerability reflects full system compromise risks. Applications using vm2 to execute untrusted code, including plugin systems, template sandboxes, and security analysis platforms, face immediate exploitation risk. The attack requires no authentication, user interaction, or elevated privileges, making it trivial to weaponize.
Organizations must immediately update vm2 to version 3.10.2 or later. The patch properly sanitizes globalPromise.prototype.then callbacks, closing the exploitation chain. No workarounds mitigate the vulnerability; patching is mandatory for secure operation.
Based on reporting by GBHackers.