Not scored
CVE-2026-22709
vm2 has a Sandbox Escape
patriksimekvm2
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
1.3%probability of exploitation in the next 30 days
Higher than 70% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 27 Jan · 04:40 UTC | SecurityOnline | CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of Apps |
| Tue 27 Jan · 22:15 UTC | StepSecurity | CVE-2026-22709: Critical Sandbox Escape Vulnerability in vm2 |
| Wed 28 Jan · 14:35 UTC | The Hacker News | Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution |
- Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code ExecutionThe Hacker News
- CVE-2026-22709: Critical Sandbox Escape Vulnerability in vm2StepSecurity
- CVSS 9.8 Sandbox Escape: Critical vm2 Flaw Exposes Millions of AppsSecurityOnline · first in our coverage