Multiple Critical Flaws in vm2 Node.js Sandbox Allow Escape and Remote Code Execution
Researchers have disclosed a series of high-severity vulnerabilities in the vm2 sandboxing library for Node.js that, in a number of cases, let untrusted JavaScript break out of the sandbox and execute code on the host system.
vm2 is an open-source module designed to execute third-party or untrusted JavaScript inside an isolated environment. It attempts to protect the host by intercepting and proxying JavaScript objects so that sandboxed code cannot reach system resources or sensitive APIs.
CVE-2026-24118 (CVSS 9.8) – A flaw tied to the “__lookupGetter__” mechanism can be exploited to escape vm2’s isolation and run arbitrary instructions on the underlying host. This issue impacts versions up to and including 3.10.4 and was addressed in 3.11.0.
CVE-2026-24120 (CVSS 9.8) – This issue is a bypass of the earlier CVE-2023-37466 fix. An attacker could use the species property on Promise objects to break out of the sandbox and trigger arbitrary command execution. The vulnerability affects versions up to 3.10.3 and was fixed in 3.10.5.
CVE-2026-24781 (CVSS 9.8) – A problem involving the “inspect” function permits sandbox escape and subsequent arbitrary code execution on the host. Versions at or below 3.10.3 are affected; patches were released in 3.11.0.
CVE-2026-26332 (CVSS 9.8) – An issue related to “SuppressedError” allows an attacker-controlled context to break isolation and execute code on the host. The flaw impacts versions up to 3.10.4 and was corrected in 3.11.0.
CVE-2026-26956 (CVSS 9.8) – A defense failure triggered by a TypeError during Symbol-to-string coercion enables sandbox escape and remote command execution. This was observed in vm2 version 3.10.4 (confirmed on Node.js 25.6.1) and fixed in 3.10.5.
CVE-2026-43997 (CVSS 10.0) – A code injection weakness can be leveraged to obtain the host Object, break out of the sandbox, and reach arbitrary code execution. This affects versions up to 3.10.5 and was patched in 3.11.0.
CVE-2026-43999 (CVSS 9.9) – A bypass in NodeVM’s internal allowlist enables loading of builtins that should be excluded (for example, child_process), allowing attackers to achieve remote code execution. The vulnerability was present in 3.10.5 and repaired in 3.11.0.
CVE-2026-44005 (CVSS 10.0) – Malicious JavaScript can escape the sandbox and introduce prototype pollution. This affects vm2 releases from 3.9.6 through 3.10.5 and was addressed in 3.11.0.
CVE-2026-44006 (CVSS 10.0) – A code-injection path via “BaseHandler.getPrototypeOf” allows escaping the sandbox and running arbitrary host-side code. Versions up to 3.10.5 are impacted; fixes landed in 3.11.0.
CVE-2026-44007 (CVSS 9.1) – Improper access control in the library makes it possible to leave the sandbox and execute operating-system-level commands on the host. This affects releases up to 3.11.0 and was corrected in 3.11.1.
CVE-2026-44008 (CVSS 9.8) – A vulnerability involving “neutralizeArraySpeciesBatch()” permits sandbox escape and arbitrary command execution on the host. It affects versions up to 3.11.1 and was patched in 3.11.2.
CVE-2026-44009 (CVSS 9.8) – A null prototype exception vulnerability can be abused to break isolation and run arbitrary host commands. This impacts versions up to 3.11.1 and received a fix in 3.11.2.
These disclosures come shortly after vm2 maintainer Patrik Simek released a patch for an earlier critical sandbox escape (CVE-2026-22709, CVSS 9.8) that also allowed arbitrary code execution on the host.
The succession of bypasses highlights how difficult it is to fully contain untrusted JavaScript in sandbox environments. Simek has previously warned that additional bypasses were likely to surface over time.
Administrators and developers who run vm2 should upgrade to the latest stable release (3.11.2) to get all available fixes. Staying current with patches is the best mitigation against these sandbox escape and remote code execution risks.