Critical Vulnerabilities in vm2 Node.js Library Allow Sandbox Escape and Arbitrary Code Execution
A dozen critical security vulnerabilities have been disclosed in the vm2 open-source Node.js library, which is designed to securely run untrusted JavaScript code within a sandbox. These flaws could be exploited to bypass sandbox protections and execute arbitrary code on vulnerable systems.
What happened
Researchers disclosed a series of critical security weaknesses in the vm2 Node.js library, which is widely used to execute untrusted JavaScript code securely within isolated environments. The identified vulnerabilities allow attackers to break out of the sandbox mechanism that vm2 implements, potentially leading to arbitrary code execution on the host system. The vulnerabilities arise from flaws in how vm2 intercepts and proxies JavaScript objects to isolate sandboxed code from the host environment.
Why it matters
vm2’s primary purpose is to prevent untrusted code from accessing or manipulating the host system by enforcing sandbox restrictions. The discovered vulnerabilities compromise this essential security boundary, exposing applications relying on vm2 to potential remote code execution attacks. Exploitation of these flaws undermines trust in sandboxing as a defense technique in Node.js environments, increasing risk for developers and organizations that depend on vm2 for safe code execution.
What security teams should do
Security teams and developers using vm2 should closely monitor official communications from the vm2 maintainers and apply any patches or updates as soon as they are released. It is important to review applications that incorporate vm2 for potential exposure and consider additional containment or mitigation strategies until a secure version is deployed. Continuous monitoring for unusual activity and restricting the execution of untrusted code can help reduce exploitation risks during this period.
Key technical details
The vulnerabilities in vm2 stem from its handling of JavaScript objects within the sandbox, where interception and proxying mechanisms fail to fully isolate the sandboxed scripts. This failure enables an attacker controlling the sandbox environment to escape it and execute arbitrary commands on the host system. The flaws collectively affect critical security assumptions of the vm2 sandbox, which is intended to safeguard host interactions by mediating access to native JavaScript objects and APIs.
Affected organizations/products
These vulnerabilities impact applications and environments that depend on the vm2 Node.js library for sandboxing untrusted JavaScript code. As an open-source project commonly used in Node.js contexts, any system integrating vm2 without mitigation measures or updated patches may be vulnerable to sandbox escape attacks.
Source attribution
https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html
