CVE-2026-22709: vm2 Node.js Sandbox RCE Vulnerability

CVE-2026-22709 Overview

CVE-2026-22709 is a critical sandbox escape vulnerability affecting vm2, an open source virtual machine/sandbox for Node.js. The vulnerability exists in versions prior to 3.10.2 where the Promise.prototype.then and Promise.prototype.catch callback sanitization mechanisms can be bypassed. This flaw allows attackers to escape the sandbox environment and execute arbitrary code on the underlying host system.

The root cause lies in inconsistent sanitization between local and global Promise objects. While localPromise.prototype.then callbacks are properly sanitized in lib/setup-sandbox.js, the corresponding globalPromise.prototype.then callbacks are not. Since async functions return globalPromise objects, attackers can exploit this oversight to break out of the sandbox.

Critical Impact

Attackers can bypass sandbox isolation and execute arbitrary code on the host system, potentially leading to complete system compromise in applications using vm2 for untrusted code execution.

Affected Products

• vm2 versions prior to 3.10.2
• Node.js applications utilizing vm2 for sandboxed code execution
• Server-side JavaScript environments relying on vm2 for isolation

Discovery Timeline

• January 26, 2026 - CVE-2026-22709 published to NVD
• January 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22709

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-94) and represents a fundamental flaw in the sandbox isolation mechanism of vm2. The vm2 library is designed to execute untrusted JavaScript code safely by providing a sandbox environment that restricts access to Node.js internals and the host system.

The vulnerability exploits an incomplete sanitization implementation where Promise callback handlers on the global Promise prototype are not properly sanitized. When sandboxed code uses async functions, the returned Promise objects are instances of globalPromise rather than localPromise. This creates a pathway for malicious code to escape the sandbox boundary by leveraging the unsanitized .then() and .catch() methods on these global Promise objects.

Root Cause

The root cause stems from asymmetric security controls in lib/setup-sandbox.js. The sandbox implementation correctly sanitizes callbacks passed to localPromise.prototype.then, but fails to apply the same sanitization to globalPromise.prototype.then. Since JavaScript async functions inherently return global Promise objects, any code utilizing async/await patterns can potentially bypass the sandbox's callback sanitization entirely.

Attack Vector

The attack vector is network-accessible, requiring no authentication or user interaction. An attacker who can submit JavaScript code for execution within a vm2 sandbox can craft a payload utilizing async functions and Promise callbacks to escape the sandbox. The attack flow involves:

1. Creating an async function within the sandbox
2. Leveraging the returned globalPromise object
3. Attaching a callback via the unsanitized .then() method
4. Executing arbitrary code outside the sandbox context

The following patch demonstrates how the vulnerability was addressed by using Reflect.apply instead of direct .call() invocation on Promise handlers:

 			return apply(origOnRejected, this, [error]);
 		};
 	}
-	return globalPromiseThen.call(this, onFulfilled, onRejected);
+	return apply(globalPromiseThen, this, [onFulfilled, onRejected]);
 };
 
 globalPromise.prototype.catch = function _catch(onRejected) {

Source: GitHub Commit Update

Detection Methods for CVE-2026-22709

Indicators of Compromise

• Unexpected process spawning or command execution originating from Node.js processes running vm2
• Anomalous network connections or file system access from sandboxed application contexts
• Error logs showing unexpected Promise-related exceptions in vm2 execution paths
• Signs of privilege escalation or lateral movement following JavaScript code submission

Detection Strategies

• Implement runtime monitoring for child process creation from vm2-enabled applications
• Deploy application-level logging to capture all code submitted for sandbox execution
• Use security tools to detect unusual JavaScript patterns involving async functions and Promise manipulation
• Monitor for attempts to access Node.js internals like require, process, or child_process

Monitoring Recommendations

• Enable verbose logging in applications using vm2 to capture execution traces
• Implement network egress monitoring for unexpected connections from sandbox-running processes
• Set up alerts for file system modifications outside expected application directories
• Consider deploying runtime application self-protection (RASP) solutions for Node.js environments

How to Mitigate CVE-2026-22709

Immediate Actions Required

• Upgrade vm2 to version 3.10.2 or later immediately
• Audit all applications using vm2 to identify exposure
• Temporarily disable vm2-based code execution features if immediate patching is not possible
• Review application logs for potential exploitation attempts

Patch Information

The vulnerability has been addressed in vm2 version 3.10.2. The fix modifies the Promise handler implementation to use Reflect.apply instead of direct method invocation, ensuring consistent sanitization across both local and global Promise objects.

Patch Details:

• Fixed Version:3.10.2
• Patch Commit:4b009c2d4b1131c01810c1205e641d614c322a29
• Release Notes:GitHub Release v3.10.2
• Security Advisory:GHSA-99p7-6v5w-7xg8

Workarounds

• Restrict or disable the ability for untrusted users to submit code for sandbox execution
• Implement additional input validation to block async function patterns before sandbox execution
• Deploy vm2 within an additional isolation layer such as Docker containers with restricted capabilities
• Consider alternative sandboxing solutions if immediate upgrade is not feasible

# Update vm2 to the patched version
npm update vm2@3.10.2

# Verify installed version
npm list vm2

# Alternative: lock to specific patched version in package.json
npm install vm2@3.10.2 --save-exact