Vulnerabilities & Exploits
vm2’s Sandbox Breakouts Multiply Beyond One Fix vm2 is acting less like a single bug and more like a broken containment boundary. The patch-for-one-CVE mindset fails here, because the disclosure has expanded into a cluster of sandbox escapes across older releases, and any reachable escape turns tenant-supplied JavaScript into host-level code execution inside the Node.js app.
The latest report lists a dozen critical flaws, including CVE-2026-24118 , CVE-2026-24120 , CVE-2026-24781 , CVE-2026-26332 , CVE-2026-26956 , CVE-2026-43997 , and others, affecting vm2 versions through 3.11.1 . Maintainers have released vm2 3.11.2 , which shifts this from a single-exploit notice to broad patching across multiple release lines.
For teams using vm2 to isolate untrusted code, the blast radius is the host application and whatever it can already reach: secrets, files, and network access. The practical risk is that older fixes did not close every escape hatch, so a partially patched deployment can still be one sandboxed script away from full compromise.
3 sources · May 8
CVE-2026-22709 NVD KEV
CVSS 9.8 CRITICAL: vm2 is an open source vm/sandbox for Node.js. EPSS 1% (68th percentile).
CVE-2026-26956 NVD KEV
CVSS 9.8 CRITICAL: vm2 is an open source vm/sandbox for Node.js. EPSS 0.9% (56th percentile).
Timeline Sources May 8 Socket.dev
Socket Releases Free Certified Patches for Critical vm2 Sand...
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
original May 7 The Hacker News
vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
12 vm2 flaws (CVSS up to 10.0) enable sandbox escape in ≤3.11.1, causing remote code execution risk; patched in 3.11.2.
original May 6 BleepingComputer
Critical vm2 sandbox bug lets attackers execute code on hosts
A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system.
original Part of the PlainSec briefing for 2026-05-07
Every edition of this story: vm2’s Sandbox Breakouts Multiply Beyond One Fix
More from today Vulnerabilities & Exploits
vm2’s Sandbox Breakouts Multiply Beyond One Fix vm2 is acting less like a single bug and more like a broken containment boundary. The patch-for-one-CVE mindset fails here, because the disclosure has expanded into a cluster of sandbox escapes across older releases, and any reachable escape turns tenant-supplied JavaScript into host-level code execution inside the Node.js app.
The latest report lists a dozen critical flaws, including CVE-2026-24118 , CVE-2026-24120 , CVE-2026-24781 , CVE-2026-26332 , CVE-2026-26956 , CVE-2026-43997 , and others, affecting vm2 versions through 3.11.1 . Maintainers have released vm2 3.11.2 , which shifts this from a single-exploit notice to broad patching across multiple release lines.
For teams using vm2 to isolate untrusted code, the blast radius is the host application and whatever it can already reach: secrets, files, and network access. The practical risk is that older fixes did not close every escape hatch, so a partially patched deployment can still be one sandboxed script away from full compromise.
3 sources · May 8
CVE-2026-22709 NVD KEV
CVSS 9.8 CRITICAL: vm2 is an open source vm/sandbox for Node.js. EPSS 1% (68th percentile).
CVE-2026-26956 NVD KEV
CVSS 9.8 CRITICAL: vm2 is an open source vm/sandbox for Node.js. EPSS 0.9% (56th percentile).
Timeline Sources May 8 Socket.dev
Socket Releases Free Certified Patches for Critical vm2 Sand...
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
original May 7 The Hacker News
vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
12 vm2 flaws (CVSS up to 10.0) enable sandbox escape in ≤3.11.1, causing remote code execution risk; patched in 3.11.2.
original May 6 BleepingComputer
Critical vm2 sandbox bug lets attackers execute code on hosts
A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system.
original Part of the PlainSec briefing for 2026-05-07
Every edition of this story: vm2’s Sandbox Breakouts Multiply Beyond One Fix
More from today