12 Critical Sandbox Escape Flaws in vm2 Node.js Library Enable Arbitrary Code Execution

Security researchers have disclosed twelve critical vulnerabilities in vm2, one of the most widely used Node.js sandbox libraries, all of which allow attackers to escape the sandbox and execute arbitrary code directly on the underlying host system.

The vm2 library is an open-source Node.js module used by developers to run untrusted JavaScript code inside a secure sandbox. It achieves this by intercepting and proxying JavaScript objects to prevent sandboxed code from accessing the host environment. Its widespread adoption across enterprise development pipelines, serverless functions, and SaaS platforms makes this disclosure significant for any organisation running Node.js-based infrastructure.

All twelve vulnerabilities have been patched by maintainer Patrik Simek. Users must update to version 3.11.2 immediately.

The Twelve Vulnerabilities at a Glance

Three of the twelve flaws carry a perfect CVSS score of 10.0. All allow sandbox escape and arbitrary code execution. The full list is as follows:

• CVE-2026-24118 (CVSS 9.8)
  Sandbox escape via __lookupGetter__. Affects versions up to 3.10.4. Patched in 3.11.0.
• CVE-2026-24120 (CVSS 9.8)
  Bypass of a prior patch (CVE-2023-37466) via the species property of promise objects. Affects versions up to 3.10.3. Patched in 3.10.5.
• CVE-2026-24781 (CVSS 9.8)
  Sandbox escape via the inspect function. Affects versions up to 3.10.3. Patched in 3.11.0.
• CVE-2026-26332 (CVSS 9.8)
  Sandbox escape via SuppressedError. Affects versions up to 3.10.4. Patched in 3.11.0.
• CVE-2026-26956 (CVSS 9.8)
  Protection mechanism failure triggered by a TypeError produced by Symbol-to-string coercion. Affects version 3.10.4 on Node.js 25.6.1. Patched in 3.10.5.
• CVE-2026-43997 (CVSS 10.0)
  Code injection allowing an attacker to obtain the host Object and escape the sandbox. Affects versions up to 3.10.5. Patched in 3.11.0.
• CVE-2026-43999 (CVSS 9.9)
  Bypass of NodeVM's built-in allowlist enabling the loading of excluded builtins including child_process, leading to remote code execution. Affects version 3.10.5. Patched in 3.11.0.
• CVE-2026-44005 (CVSS 10.0)
  Attacker-controlled JavaScript escapes the sandbox and enables prototype pollution. Affects versions 3.9.6 through 3.10.5. Patched in 3.11.0.
• CVE-2026-44006 (CVSS 10.0)
  Code injection via BaseHandler.getPrototypeOf enabling sandbox escape and remote code execution. Affects versions up to 3.10.5. Patched in 3.11.0.
• CVE-2026-44007 (CVSS 9.1)
  Improper access control allowing sandbox escape and execution of arbitrary operating system commands. Affects versions up to 3.11.0. Patched in 3.11.1. This vulnerability was discovered and reported by Akshat Sinha, Senior Site Reliability Engineer at Rubrik.
• CVE-2026-44008 (CVSS 9.8)
  Sandbox escape via neutralizeArraySpeciesBatch(). Affects versions up to 3.11.1. Patched in 3.11.2.
• CVE-2026-44009 (CVSS 9.8)
  Sandbox escape via a null prototype exception. Affects versions up to 3.11.1. Patched in 3.11.2.

Why This Pattern Matters Beyond a Single Library

This disclosure is the latest in a sustained pattern of sandbox escape vulnerabilities in vm2. In early 2026, maintainer Patrik Simek released patches for another critical escape flaw, CVE-2026-22709, which also carried a CVSS score of 9.8. Simek has previously acknowledged that new bypass techniques will likely continue to emerge.

The accumulation of escapes illustrates a structural challenge: securely isolating untrusted JavaScript code inside a JavaScript runtime is inherently difficult. JavaScript's flexibility, the complexity of its prototype chain, and the breadth of built-in objects create a very large attack surface for sandbox implementations to defend.

For enterprise security teams, this matters because vm2 is often embedded deep within third-party tooling, CI/CD pipelines, serverless function runtimes, and SaaS platforms without direct visibility. Organisations may be running vm2-dependent code without realising it.

What to Check and What to Do

Security and development teams should take the following actions immediately:

• Audit all Node.js applications and dependencies for any direct or transitive use of the vm2 library using npm audit or a software composition analysis tool.
• Update any affected installations to vm2 version 3.11.2, which contains patches for all twelve disclosed vulnerabilities.
• Review third-party packages and SaaS platforms that may embed vm2, and confirm with vendors that they are running a patched version.
• Treat any environment that runs untrusted JavaScript code as potentially compromised if it was running vm2 versions prior to 3.11.2 without monitoring.

Enterprise development teams operating in the GCC and MENA region building on Node.js, particularly those deploying serverless workloads on AWS Lambda, Azure Functions, or Google Cloud Functions, should treat this as an urgent supply chain security review given the severity and volume of the disclosures.