"The open-source vm2 library creates a secure context to allow users to execute untrusted JavaScript code that does not have access to the filesystem. vm2 has historically been seen in SaaS platforms that support user script execution, online code runners, chatbots, and open-source projects, being used in more than 200,000 projects on GitHub. The project was discontinued in 2023, though, due to repeated sandbox-escape vulnerabilities, and considered unsafe for running untrusted code."
"While vm2 sanitizes callbacks attached to its own internal Promise implementation, async functions return a global Promise whose .then() and.catch() callbacks are not properly sanitized. "In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed," the project maintainer says, adding that "this allows attackers to escape the sandbox and run arbitrary code." According to the developer, the CVE-2026-22709 sandbox escape was partially addressed in vm2 version 3.10.1, while in the subsequent 3.10.2 update the developer tightened the fix to avoid a potential bypass."
vm2 provides a secure JavaScript sandbox intended to run untrusted code without filesystem access. The library has broad use across SaaS platforms, online code runners, chatbots, and over 200,000 GitHub projects, and receives about one million weekly npm downloads. The project was discontinued in 2023 due to repeated sandbox-escape vulnerabilities but was resurrected in October with release 3.10.0 addressing known issues and preserving Node 6 compatibility. CVE-2026-22709 stems from improper Promise sanitization: async functions return global Promise callbacks (.then/.catch) that are not sanitized, enabling sandbox escape and arbitrary host code execution. Fixes in 3.10.1 and 3.10.2 partially and then more fully addressed the issue, and exploit code demonstrating the trigger was shared.
Read at BleepingComputer
Unable to calculate read time
Collection
[
|
...
]