CVE-2026-22709 vm2 has a Sandbox Escape

vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of...

PT-2023-23723

Name of the Vulnerable Software and Affected Versions vm2 versions 3.9.17 and lower Description The issue allows a threat actor to get a read-write reference to the node inspect method and edit options for console.log, resulting in the ability to edit options for the console.log command. This was...

Vm2 security vulnerabilities

Vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. Vm2 suffers from a security vulnerability that stems from a vulnerability in package vm2 prior to 3.9.4. An attacker ca...

Sandbox Bypass

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Sandbox Bypass. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit...