vm2 Node.js Library Suffers Dozen Critical Security Vulnerabilities

The open‑source vm2 library, used to run untrusted JavaScript in a sandbox, has been found to contain twelve critical security flaws that allow attackers to escape the sandbox and execute arbitrary code on the host system. The vulnerabilities arise from the library’s interception and proxying of JavaScript objects, which can be abused to bypass sandbox restrictions. Exploits enable prototype pollution, remote code execution via eval, and privilege escalation to the host process. Attackers can load arbitrary native modules, spawn shell commands, and exfiltrate data from the host environment. Both vm2 v2.x and v3.x releases are affected, and the flaws were disclosed in early 2026. The severity of the issues demands immediate remediation to protect any applications that rely on vm2 for sandboxing. Organizations using vm2 should upgrade to the latest patch to eliminate the risk of code execution and data compromise.