Vm2
CVE-2026-22709
CRITICAL
GHSA-99p7-6v5w-7xg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDefine async function returning globalPromise
-
ExploitAttach unsanitized callback to Promise.then
-
ExecutionCallback executes outside sandbox context
-
ImpactExecute arbitrary Node.js code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | vm2 version prior to 3.10.2 with default sandbox configuration. Attacker must be able to execute code within the sandbox that uses async functions or Promise objects, which is the standard intended use of vm2. |
| Impact | CVSS 9.8. vm2 is a widely-used Node.js sandbox — escape provides full host access. |
| Exploit ScenarioDerived | Attacker crafts code using Promise callbacks to escape the vm2 sandbox and execute arbitrary code in the host Node.js process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Sandbox escape in vm2 Node.js sandbox before 3.10.2 via Promise.prototype.then/catch callback sanitization bypass. PoC and patch available.
Earlier versions of this analysis (1)
Promise callback sandbox escape in vm2.
RemediationAI
Update to vm2 3.10.2.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-94 in vm2's Promise sanitization. The then() and catch() callback handling doesn't properly restrict access to the host environment.
Know when Vm2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of localPromise.prototype.then is sanitized, but globalPromise.prototype.then is not sanitized. The return value of async functions is globalPromise object. Version 3.10.2 fixes the issue.
Blast Radius
ecosystem impact- 13 npm packages depend on vm2 (3 direct, 10 indirect)
Ecosystem-wide dependent count for version 3.10.2.
Executive ViewAI
CVE-2026-22709 is a critical vulnerability in vm2 that allows attackers to bypass sandbox protections through Promise callback manipulation, potentially enabling arbitrary code execution. Organizations using vm2 for sandboxing untrusted code face immediate risk of compromise and must prioritize remediation to prevent data exfiltration and system takeover.
Apply vendor patch. Additionally, implement network segmentation to restrict vm2 process communication, disable Promise functionality if operationally feasible, enforce strict input validation on all code destined for sandboxing, and implement runtime monitoring for suspicious Promise chain behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
vm2 is an advanced vm/sandbox for Node.js. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitab
vm2 is a sandbox that can run untrusted code with Node's built-in modules. Rated critical severity (CVSS 10.0), this vul
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 10.
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15,
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 10.
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Full sandbox escape with arbitrary code execution allows remote attackers to break out of vm2's Node.js sandbox environm
Sandbox escape in vm2 for Node.js allows remote unauthenticated attackers to execute arbitrary commands on the host syst
Sandbox escape in vm2 (patriksimek/vm2) versions prior to 3.11.3 enables remote code execution on the host Node.js proce
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Rated critical severity (CVSS 9.8
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the We
Sandbox escape in the vm2 Node.js library through 3.11.6 lets untrusted code running inside a NodeVM instance reach the
Exploit-DB