UpTrajectory Review
Recent findings have uncovered thirteen critical vulnerabilities in the vm2 JavaScript sandbox package, which could allow malicious code to escape its confines and compromise IT systems. Developers utilizing this library are strongly advised to upgrade to the latest version, 3.11.2, to mitigate these risks. The vulnerabilities include a particularly severe one, CVE-2026-26956, which enables arbitrary code execution from within the sandbox.
For small business operators, this situation underscores the importance of maintaining up-to-date software dependencies. The potential for a sandbox escape poses a significant threat, especially for applications that process user-supplied JavaScript. While the vulnerability may not affect all deployments, the narrow conditions under which it can be exploited highlight the need for vigilance. Businesses should prioritize patching and reassessing their sandbox configurations to ensure they are not inadvertently exposing themselves to attacks.
Takeaway: Update your vm2 package immediately to safeguard against critical vulnerabilities.
Excerpt from the original — InfoWorld
Thirteen critical vulnerabilities have been found in the vm2 JavaScript sandbox package that could allow an attacker’s code to escape the container and do nasty things to IT environments. As a result, developers using this library in their applications are urged to update the software to the latest version, which is currently 3.11.2.
The warnings come in advisories from vm2 maintainer Patrik Simek.
vm2 is an open source vm/sandbox that can run untrusted code with whitelisted Node.js’s built-in modules.
One of the more serious of the 13 vulnerabilities is CVE-2026-26956, a full sandbox escape with arbitrary code execution. Attacker code that is inside VM.run() can obtain host process object and runs host commands with zero co-operation from the host.
However, researchers at Socket told us in an email that the advisory about this escape says it has been confirmed only on …