:javascript: Critical vm2 Node.js Flaw allows Sandbox Escape and Arbitrary Code Execution.
A critical sandbox escape vulnerability has been disclosed in the popular vm2 Node.js library that, if successfully exploited, could allow attackers to run arbitrary code on the underlying operating system.
⁉️The vulnerability, tracked as CVE-2026-22709, carries a CVSS score of 9.8 out of 10.0 on the CVSS scoring system.⁉️
#vm2 #nodejs #sandbox #escape #arbitrary #code #execution #it #security #privacy #engineer #media #secure #javascript #programming #developer #tech #news
![⁉️"In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed," vm2 maintainer Patrik Simek said. "This allows attackers to escape the sandbox and run arbitrary code."⁉️
<https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8>
vm2 is a Node.js library used to run untrusted code within a secure sandboxed environment by intercepting and proxying JavaScript objects to prevent sandboxed code from accessing the host environment.
<https://github.com/patriksimek/vm2>
<https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy>
The newly discovered flaw stems from the library's improper sanitization of Promise handlers, which creates an escape vector that results in the execution of arbitrary code outside the sandbox boundaries.
<https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise>
"The critical insight is that async functions in JavaScript return `globalPromise` objects, not `localPromise` objects. Since `globalPromise.prototype.then` and `globalPromise.prototype.catch` are not properly sanitized [unlike `localPromise`]," Endor Labs researchers Peyton Kennedy and Cris Staicu said.
👾In light of the criticality of the flaw, users are recommended to update to the most recent version [3.10.3], which comes with fixes for additional sandbox escapes.👾
<https://github.com/patriksimek/vm2/releases/tag/v3.10.3>](https://files.mastodon.social/cache/media_attachments/files/116/001/368/055/155/609/original/510dc1dbf0a3bcc0.jpeg)
