The recently disclosed vm2 Node.js library vulnerabilities highlight a serious and growing risk in modern application environments: sandbox escape. As per public reporting, multiple critical vulnerabilities in the vm2 library could allow attackers to break out of the intended JavaScript sandbox and execute arbitrary code on the underlying host system. Several of these vulnerabilities carry critical CVSS scores, including 9.8, 9.9, and 10.0, with affected versions receiving patches across vm2 3.10.5, 3.11.0, 3.11.1, and 3.11.2.


This is an important reminder that “sandboxed” does not automatically mean “safe.” Any system that executes untrusted code, such as automation platforms, plug-in engines, AI tools, developer portals, workflow engines, or server-side JavaScript environments, must be treated as a high-risk execution surface. Because naturally, the moment we invent a box to contain code, someone starts working out how to escape the box. 

The larger lesson is clear: application-layer vulnerabilities can quickly become infrastructure-level incidents. Security teams should not rely only on the application sandbox. They need layered visibility across applications, users, DNS, web traffic, and network behavior.

A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible systems. vm2 is an open-source library used to run untrusted JavaScript code inside a secure sandbox by intercepting and proxying JavaScript objects to prevent sandboxed code from accessing the host

Source: vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution via The Hacker News — published 07 May 2026.