A critical sandbox escape vulnerability in the vm2 Node.js library could allow attackers to run arbitrary code on host systems. The flaw is tracked as CVE-2026-22709 and carries a CVSS score of 9.8.
KEY FACTS
- Incident CVE-2026-22709 sandbox escape
- Severity CVSS 9.8
- Cause Promise handler sanitization bypass in vm2 3.10.0
- Mitigation Update to vm2 3.10.3
In a technical analysis by Endor Labs researchers said the flaw stems from improper sanitization of Promise handlers and that async functions return globalPromise objects rather than localPromise objects, allowing global promise handlers to bypass sandboxing.
vm2 is a library that runs untrusted JavaScript inside a sandbox by intercepting and proxying objects to prevent access to the host environment. The bypass targets Promise.prototype.then and Promise.prototype.catch handlers that were not sanitized in the global promise prototype.
The library has experienced several sandbox escape vulnerabilities since 2022. The project README and SECURITY.md were updated in October 2025 to state that vm2 3.x is being actively maintained.
Users are advised to update to the latest release, vm2 3.10.3, as published in the GitHub release vm2 release v3.10.3, which includes fixes for this and additional sandbox escape issues.
WHY IT MATTERS
A successful exploit can let untrusted code break isolation and execute commands on the host, posing a high risk to services that run user supplied scripts. Operators should apply the update or consider stronger isolation such as isolated-vm or containerisation.