A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible systems.
vm2 is an open-source library used to run untrusted JavaScript code inside a secure sandbox by intercepting and proxying JavaScript objects to prevent sandboxed code from accessing the host environment.
The security flaws are listed below –
- CVE-2026-24118 (CVSS score: 9.8) – A vulnerability that allows sandbox escape via “__lookupGetter__” and permits an attacker to run arbitrary code on the underlying host. (Affects versions <= 3.10.4, patches in 3.11.0)
- CVE-2026-24120 (CVSS score: 9.8) – A patch bypass for CVE-2023-37466 (CVSS score: 9.8) that could allow attackers to escape the sandbox through the species property of promise objects and execute arbitrary commands on the underlying host. (Affects versions <= 3.10.3, patched in 3.10.5)
- CVE-2026-24781 (CVSS score: 9.8) – A vulnerability that allows sandbox escape via the “inspect” function and permits an attacker to run arbitrary code on the underlying host. (Affects versions <= 3.10.3, patches in 3.11.0)
- CVE-2026-26332 (CVSS score: 9.8) – A vulnerability that allows sandbox escape via “SuppressedError” and permits an attacker to run arbitrary code on the underlying host. (Affects versions <= 3.10.4, patches in 3.11.0)
- CVE-2026-26956 (CVSS score: 9.8) – A protection mechanism failure vulnerability that allows sandbox escape with arbitrary code execution by triggering a TypeError produced by Symbol-to-string coercion. (Affects version 3.10.4, confirmed on Node.js 25.6.1, patched in 3.10.5)
- CVE-2026-43997 (CVSS score: 10.0) – A code injection vulnerability that allows an attacker to obtain the host Object and escape the sandbox, leading to arbitrary code execution. (Affects versions <= 3.10.5, patched in 3.11.0)
- CVE-2026-43999 (CVSS score: 9.9) – A vulnerability that allows a bypass of NodeVM’s built-in allowlist and enables an attacker to load excluded builtins like child_process and achieve remote code execution. (Affects version 3.10.5, patched in 3.11.0)
- CVE-2026-44005 (CVSS score: 10.0) – A vulnerability that allows attacker-controlled JavaScript to escape the sandbox and enable prototype pollution. (Affects versions 3.9.6-3.10.5, patched in 3.11.0)
- CVE-2026-44006 (CVSS score: 10.0) – A code injection vulnerability via “BaseHandler.getPrototypeOf” that enables sandbox escape and remote code execution. (Affects versions <= 3.10.5, patched in 3.11.0)
- CVE-2026-44007 (CVSS score: 9.1) – An improper access control vulnerability that allows sandbox escape and execution of arbitrary operating system commands on the underlying host. (Affects versions <= 3.11.0, patched in 3.11.1)
- CVE-2026-44008 (CVSS score: 9.8) – A vulnerability that allows sandbox escape via “neutralizeArraySpeciesBatch()” and permits an attacker to execute arbitrary commands on the underlying host. (Affects versions <= 3.11.1, patched in 3.11.2)
- CVE-2026-44009 (CVSS score: 9.8) – A vulnerability that allows sandbox escape via a null proto exception and permits an attacker to execute arbitrary commands on the underlying host. (Affects versions <= 3.11.1, patched in 3.11.2)
The disclosure comes a couple of months after vm2 maintainer Patrik Simek released patches for another critical sandbox escape flaw (CVE-2026-22709, CVSS score: 9.8) that could lead to arbitrary code execution on the underlying host system.
The string of newly identified sandbox escapes illustrates the challenge of securely isolating untrusted code in JavaScript-based sandbox environments, with Simek acknowledging previously that new bypasses will likely be discovered in the future. Users of vm2 are advised to update to the latest version (3.11.2) for optimal protection.
