Sandbox Escape Vulnerability in vm2 for Node.js by Patrik Simek

CVE-2026-45411

What is CVE-2026-45411?

The vm2 library, an open source sandbox for Node.js, has a vulnerability that allows attackers to exploit the yield* expression in async generators prior to version 3.11.3. This flaw enables the escape from the VM2 sandbox environment, permitting arbitrary command execution on the underlying host system. When the async generator is closed and the return function is invoked, any exceptions encountered are caught and transmitted to the yield* iterator, creating a pathway for malicious actions. It is crucial for users to update to vm2 version 3.11.3 or later to safeguard against this risk. For further information, refer to the security advisory at GitHub: https://github.com/patriksimek/vm2/security/advisories/GHSA-248r-7h7q-cr24.

References