Vulnerabilities · 130 days ago

vm2’s Sandbox Breakouts Multiply Beyond One Fix

vm2 is acting less like a single bug and more like a broken containment boundary. The patch-for-one-CVE mindset fails here, because the disclosure has expanded into a cluster of sandbox escapes across older releases, and any reachable escape turns tenant-supplied JavaScript into host-level code execution inside the Node.js app.

The latest report lists a dozen critical flaws, including CVE-2026-24118, CVE-2026-24120, CVE-2026-24781, CVE-2026-26332, CVE-2026-26956, CVE-2026-43997, and others, affecting vm2 versions through 3.11.1. Maintainers have released vm2 3.11.2, which shifts this from a single-exploit notice to broad patching across multiple release lines.

For teams using vm2 to isolate untrusted code, the blast radius is the host application and whatever it can already reach: secrets, files, and network access. The practical risk is that older fixes did not close every escape hatch, so a partially patched deployment can still be one sandboxed script away from full compromise.

CVE-2026-22709

NVD KEV

CVSS 9.8 CRITICAL: vm2 is an open source vm/sandbox for Node.js. EPSS 1% (68th percentile).

CVE-2026-26956

NVD KEV

CVSS 9.8 CRITICAL: vm2 is an open source vm/sandbox for Node.js. EPSS 0.9% (56th percentile).

Timeline

Sources

3 sources covering this story

Socket.dev May 8
Socket Releases Free Certified Patches for Critical vm2 Sand...
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
The Hacker News May 7
vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
12 vm2 flaws (CVSS up to 10.0) enable sandbox escape in ≤3.11.1, causing remote code execution risk; patched in 3.11.2.
BleepingComputer May 6
Critical vm2 sandbox bug lets attackers execute code on hosts
A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system.

Entities

CVE-2026-24118
CVE-2026-24120
CVE-2023-37466
CVE-2026-24781

Part of the PlainSec briefing for 2026-05-09

Editions

Vulnerabilities · 130 days agovm2’s Sandbox Breakouts Multiply Beyond One Fixvm2 is acting less like a single bug and more like a broken containment boundary. The patch-for-one-CVE mindset fails here, because the disclosure has expanded into a cluster of sandbox escapes across older releases, and any reachable escape turns tenant-supplied JavaScript into host-level code execution inside the Node.js app.The latest report lists a dozen critical flaws, including CVE-2026-24118, CVE-2026-24120, CVE-2026-24781, CVE-2026-26332, CVE-2026-26956, CVE-2026-43997, and others, affecting vm2 versions through 3.11.1. Maintainers have released vm2 3.11.2, which shifts this from a single-exploit notice to broad patching across multiple release lines.For teams using vm2 to isolate untrusted code, the blast radius is the host application and whatever it can already reach: secrets, files, and network access. The practical risk is that older fixes did not close every escape hatch, so a partially patched deployment can still be one sandboxed script away from full compromise.