UpTrajectory Review
Recent findings have uncovered thirteen critical vulnerabilities in the vm2 JavaScript sandbox package, which could potentially allow malicious code to escape its confines and wreak havoc on IT environments. Developers utilizing this library are strongly advised to upgrade to version 3.11.2 to mitigate these risks. The vulnerabilities, particularly CVE-2026-26956, pose a significant threat as they enable arbitrary code execution, especially under specific conditions involving Node.js versions.
For small business operators, this is a crucial moment to assess your software dependencies and ensure that your applications are secure. The narrow yet high-impact nature of these vulnerabilities means that while not every deployment is affected, those that are could face severe consequences. It's essential to stay informed about updates from the vm2 maintainers and to act swiftly to patch any vulnerabilities, especially if your applications handle user-supplied JavaScript.
Takeaway: Update your vm2 package to version 3.11.2 immediately to protect your applications.
Excerpt from the original — CSO Online
Thirteen critical vulnerabilities have been found in the vm2 JavaScript sandbox package that could allow an attacker’s code to escape the container and do nasty things to IT environments. As a result, developers using this library in their applications are urged to update the software to the latest version, which is currently 3.11.2.
The warnings come in advisories from vm2 maintainer Patrik Simek.
vm2 is an open source vm/sandbox that can run untrusted code with whitelisted Node.js’s built-in modules.
One of the more serious of the 13 vulnerabilities is CVE-2026-26956, a full sandbox escape with arbitrary code execution. Attacker code that is inside VM.run() can obtain host process object and runs host commands with zero co-operation from the host.
However, researchers at Socket told us in an email that the advisory about this escape says it has been confirmed only on …