CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of Apps

A critical vulnerability in vm2, a popular sandbox library for Node.js, has been tracked as CVE-2026-22709 and carries a maximum CVSS score of 9.8, enabling attackers to bypass the sandbox and execute arbitrary code on the host. The flaw affects vm2 versions 3.10.0 and below, posing a serious risk to any application that relies on it for isolation.

The root cause lies in how the sandbox sanitises Promise callbacks; while local Promise.prototype[.]then is sanitised, globalPromise.prototype[.]then is not, allowing an unsanitised Promise object to be exploited. By exploiting this, an attacker can access the Function constructor and generate code outside the sandbox’s restrictions, with PoC code showing loading the child_process module and running system commands.

Given vm2’s popularity, seeing over 3.7 million downloads every month, the potential impact is wide, and maintainers have released a patch urging users to upgrade to vm2 version 3.10.2 immediately to secure their sandboxes.