Critical vm2 Node.js sandbox flaw (CVE-2026-26956) enables host code execution

A critical vulnerability in the popular vm2 Node.js sandboxing library could allow attackers to escape the sandbox and execute arbitrary code on the underlying host system.

The issue is tracked as CVE-2026-26956. It has been confirmed to impact vm2 version 3.10.4, and earlier releases may also be affected.

Who is affected According to the maintainer’s advisory, the flaw impacts environments running Node.js 25 (confirmed on Node.js 25.6.1) where WebAssembly exception handling and JSTag support are enabled.

How the escape works The vulnerability stems from vm2’s handling of exceptions that cross between the sandboxed context and the host. While vm2 relies on JavaScript-level protections to isolate untrusted code, WebAssembly exception handling can intercept JavaScript errors at a lower level inside the V8 engine, bypassing vm2’s defenses.

By triggering a specially crasourcesed error, an attacker can cause a host-side error object to leak into the sandbox without being sanitized. The leaked object can then be abused to access Node.js internals (such as the process object), enabling command execution on the host.

Proof-of-concept exploit code has been published.

Mitigation Users are advised to upgrade to vm2 version 3.10.5 or later to reduce the risk of exploitation.

The disclosure follows previous sandbox-escape flaws in vm2, underscoring the difficulty of securely isolating untrusted code in JavaScript sandbox environments.