CVE-2026-22709: Critical Sandbox Escape in vm2 Enables Arbitrary Code Execution
Blog post from Endor Labs
A critical sandbox escape vulnerability identified as CVE-2026-22709 has been disclosed in vm2, a widely-used Node.js library designed to safely execute untrusted code in sandboxed environments. With a CVSS v3.1 score of 9.8, this vulnerability allows attackers to bypass Promise callback sanitization and execute arbitrary code beyond the intended sandbox boundary, highlighting the fragility of vm2, which has experienced over 20 known breakouts in previous versions. The vulnerability, published in January 2026, was found in version 3.10.0 and involves a flaw in `globalPromise.prototype.then` and `globalPromise.prototype.catch` where `Function.prototype.call` can be intercepted, allowing access to unsanitized error objects. This was patched in version 3.10.2 by substituting `Function.prototype.call()` with `Reflect.apply()`, which prevents interception. Despite the patch, the advisory emphasizes that vm2's security model is inherently fragile and recommends considering alternative approaches for executing untrusted JavaScript code, urging users to update immediately to mitigate potential exploits while also implementing additional security measures beyond relying solely on vm2's sandbox.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.