Do Son 
A critical vulnerability within the widely adopted vm2 library for Node.js has jeopardized services that execute third-party JavaScript in isolated environments. The flaw facilitates a “sandbox escape,” permitting adversaries to transcend restricted boundaries and achieve remote code execution on the host system. Given the millions of downloads via the npm ecosystem, this issue impacts not only nascent projects but also major SaaS platforms, online compilers, and automation utilities.
Designated as CVE-2026-26956, the breach has been confirmed in vm2 version 3.10.4, though antecedent releases may also be susceptible. A public Proof of Concept (PoC) has already emerged, demonstrating the successful execution of arbitrary commands on a host machine.
The vm2 library is specifically engineered to run untrusted JavaScript within a sequestered Node.js environment, designed to restrict access to sensitive system functions, such as the process object and the local file system. However, this novel defect fundamentally undermines the principle of isolation.
The root cause pertains to the handling of exceptions between the sandbox and the primary execution environment. Under standard conditions, vm2 relies on JavaScript’s intrinsic security mechanisms and specialized Proxy objects to filter interactions. Nevertheless, the integration of WebAssembly exception handling allows errors to be intercepted at a lower level of the V8 engine, thereby circumventing the library’s defensive layers.
The assault is orchestrated around a meticulously crafted TypeError generated during the conversion of a Symbol into a string. Consequently, an error object from the host environment is leaked back into the sandbox without the requisite sanitization. Because this object originates from outside the restricted perimeter, an assailant can leverage a chain of constructors to reclaim access to internal Node.js capabilities and execute arbitrary system commands.
The developer of vm2 clarified that the vulnerability is confirmed for Node.js 25.6.1 when WebAssembly exception handling and JSTag support are enabled. Users are urged to migrate to at least version 3.10.5 immediately, though version 3.11.2 is currently recognized as the most secure iteration.
For vm2, such security lapses have become increasingly commonplace. In early 2026, the library suffered another critical sandbox escape identified as CVE-2026-22709, following similar incidents documented in 2023 and 2022. This persistent series of vulnerabilities underscores the formidable challenge of reliably isolating remote code execution, even within ubiquitous and established tooling.
Donate