What happened?
Several security vulnerabilities have been fixed in the vm2 sandbox of the open-source JavaScript runtime environment Node.js. With version 3.11.4, the developers addressed a total of four "critical" vulnerabilities, each rated with the highest possible CVSS score of 10.0: CVE-2026-47208, CVE-2026-47137, CVE-2026-47140, and CVE-2026-47131. All four vulnerabilities are sandbox escapes that could allow attackers to compromise host PCs with malicious code.
The Details
The core of the problem lies in the fact that the process and inspector/promises processes are not included in Node.js's blocklist. Attackers can leverage this for a sandbox escape. Additionally, various functions can be combined using the TypeError constructor to reach the host system.
In addition to the four critical vulnerabilities, the patch closes another "critical" flaw (CVE-2026-47210), which enables an additional sandbox escape in the context of WebAssembly JSPI. Furthermore, the developers fixed three security vulnerabilities rated "high" in severity (CVE-2026-47139, CVE-2026-47209, CVE-2026-47135).
Further technical details on the individual vulnerabilities can be found in the security section of the project's GitHub website.
Context
vm2 has repeatedly made headlines since early May because attackers were able to bypass the sandbox time and again. Just recently, the developers had closed two other "critical" security vulnerabilities (CVE-2026-26956, CVE-2026-45411). The current findings thus continue a longer series of security issues affecting this sandbox solution.
This development is relevant for the security technology industry because many applications and services are based on Node.js – including in the context of video management systems, access control platforms, or web-based management interfaces for alarm systems. In the worst case, a compromised sandbox can allow attackers to gain control over the underlying host system, potentially also granting access to connected security infrastructure.
Practical Tips
- Administrators should immediately update affected systems to version 3.11.4 to close the fixed vulnerabilities.
- Systems using vm2 in conjunction with Node.js applications should have their attack surface reviewed – especially where web-based management interfaces for security technology are operated.
- Even though there is currently no known active exploitation of the vulnerabilities, patching should not be delayed, as a CVSS score of 10.0 indicates maximum theoretical damage potential.
- The security section of the vm2 project's GitHub website should be checked regularly for new advisories, as critical vulnerabilities have already occurred multiple times in quick succession.
Outlook
Given the accumulation of critical security vulnerabilities since early May, it is likely that security research on vm2 will remain active and may uncover further vulnerabilities. For operators of systems built on Node.js and vm2, this means that patch management processes should be consistently established and regularly reviewed. Details on any potential active exploitation of the current vulnerabilities are not yet known, which is why vigilance and prompt patching remain the most important protective measures at this time.
