vm2 npm Package: 25 Critical Sandbox Escape Vulnerabilities Disclosed Together
A batch of 25 vulnerabilities, including critical sandbox escapes, was disclosed for the vm2 npm package on September 17-18, 2026.
Key findings
- 25 vulnerabilities disclosed for vm2 between September 17-18, 2026, with multiple Critical severity flaws.
- Critical vulnerabilities include sandbox escapes via host API promises,
child_processaccess, and exposure of Node.js built-ins likeos,dns, andBuffer. - Several CVEs involve bypasses of allowlists and security restrictions for external packages and host object prototypes.
- Affected versions range widely, with patches available in vm2 versions 3.11.7, 3.11.8, and 3.12.1.
- Exploitation of these vulnerabilities could lead to arbitrary code execution, host memory disclosure, and denial-of-service.
- The batch includes vulnerabilities specific to Node.js versions 24 and 26, indicating environment-specific risks.
On September 17-18, 2026, a significant batch of 25 vulnerabilities was disclosed for vm2, a popular npm package used for creating sandboxed JavaScript environments. The vulnerabilities, ranging in severity from Low to Critical (CVSSv3 10.0), were reported by multiple researchers and highlight critical flaws in vm2's sandbox isolation mechanisms. These issues could allow attackers to escape the sandbox and execute arbitrary code on the host system, access sensitive information, or cause denial-of-service conditions.
Several critical vulnerabilities (CVE-2026-93606, CVE-2026-93605, CVE-2026-93604, CVE-2026-93603, CVE-2026-92960, CVE-2026-92957, CVE-2026-92956, CVE-2026-92955, CVE-2026-92953, CVE-2026-92948, CVE-2026-92947, CVE-2026-92946, CVE-2026-92941, CVE-2026-92944) stem from improper handling of host APIs, built-in modules, and JavaScript's Promise and ArrayBuffer objects. For instance, CVE-2026-93606 and CVE-2026-93603 detail sandbox escapes related to host-realm Promises and the apply trap, respectively. CVE-2026-93605 points out that the child_process module was omitted from a denylist, allowing arbitrary command execution. Similarly, CVE-2026-92960 and CVE-2026-92947 reveal vulnerabilities where os, dns, and the shared Buffer pool were exposed, enabling host identity disclosure and memory manipulation.
Other vulnerabilities focus on bypasses of security configurations and restrictions. CVE-2026-92957 and CVE-2026-92946 describe how external package allowlists could be bypassed due to improper string matching, leading to arbitrary code execution. CVE-2026-92955 highlights an escape via console._stdout and console._stderr by overwriting EventEmitter.prototype.emit. CVE-2026-92953 and CVE-2026-92948 detail how host TypedArray, ArrayBuffer prototypes, and accessor properties on frozen objects could be mutated, affecting host-created arrays and allowing direct invocation of host object setters. CVE-2026-92944, affecting Node.js 26, exploits a stale PromiseThenLookupChain protector in V8, allowing Promise bypasses.
The disclosed vulnerabilities affect various versions of vm2, with fixes primarily released in versions 3.11.7, 3.11.8, and 3.12.1. For example, CVE-2026-93606 and CVE-2026-93603 were fixed in 3.12.1, while many others, including CVE-2026-92960, CVE-2026-92957, CVE-2026-92956, CVE-2026-92955, CVE-2026-92953, CVE-2026-92947, CVE-2026-92946, CVE-2026-92941, and CVE-2026-92944, were addressed in versions prior to 3.11.7 or 3.11.8. Users are strongly advised to update to the latest patched versions to mitigate these critical security risks.
The sheer number and severity of these vulnerabilities underscore the importance of rigorous security auditing for sandboxing technologies like vm2. Developers relying on vm2 should immediately assess their deployed versions and apply updates. The interconnectedness of these flaws, often exploiting subtle interactions between JavaScript features and the Node.js environment, highlights the ongoing challenge of maintaining secure sandboxes against sophisticated attackers.
Key findings include:
- 25 vulnerabilities disclosed for vm2 between September 17-18, 2026, with multiple Critical severity flaws.
- Critical vulnerabilities include sandbox escapes via host API promises,
child_processaccess, and exposure of Node.js built-ins likeos,dns, andBuffer. - Several CVEs involve bypasses of allowlists and security restrictions for external packages and host object prototypes.
- Affected versions range widely, with patches available in vm2 versions 3.11.7, 3.11.8, and 3.12.1.
- Exploitation of these vulnerabilities could lead to arbitrary code execution, host memory disclosure, and denial-of-service.
- The batch includes vulnerabilities specific to Node.js versions 24 and 26, indicating environment-specific risks.
The disclosed vulnerabilities affect vm2 versions prior to 3.11.7, 3.11.8, and 3.12.1. Patches are available in versions 3.11.7, 3.11.8, and 3.12.1.
CVEs mentioned: CVE-2026-93606, CVE-2026-93605, CVE-2026-93604, CVE-2026-93603, CVE-2026-92960, CVE-2026-92957, CVE-2026-92955, CVE-2026-92953, CVE-2026-92948, CVE-2026-92947, CVE-2026-92946, CVE-2026-92941, CVE-2026-92944, CVE-2026-92951, CVE-2026-92950, CVE-2026-92945, CVE-2026-92942, CVE-2026-92940, CVE-2026-92939, CVE-2026-92938, CVE-2026-92937, CVE-2026-92936, CVE-2026-92935, CVE-2026-92934, CVE-2026-92933. The batch of 25 vulnerabilities disclosed for vm2 on September 17-18, 2026, reveals critical sandbox escape flaws. A stylized representation of a JavaScript code block with a broken lock icon, revealing a network of interconnected gears and circuits behind it. CVE-2026-93606, CVE-2026-93605, CVE-2026-93604, CVE-2026-93603, CVE-2026-92963, CVE-2026-92962, CVE-2026-92961, CVE-2026-92960, CVE-2026-92959, CVE-2026-92958, CVE-2026-92957, CVE-2026-92956, CVE-2026-92955, CVE-2026-92953, CVE-2026-92952, CVE-2026-92951, CVE-2026-92950, CVE-2026-92949, CVE-2026-92948, CVE-2026-92947, CVE-2026-92946, CVE-2026-92945, CVE-2026-92944, CVE-2026-92942, CVE-2026-92941