Two vulnerabilities in n8n’s sandbox mechanism could be exploited for remote code execution (RCE) on the host system.

近期，流行的Node.js库vm2被发现存在严重的沙箱逃逸漏洞，编号为CVE-2026-22709。该漏洞的CVSS评分高达9.8（满分10.0），意味着其潜在风险极高。如果攻击者成功利用该漏洞，可能在底层操作系统上执行任意代码，这对于依赖该库的应用程序安全构成重大威胁。 vm2库是用于在安全沙箱环境中运行不可信代码的工具，其设计初衷是通过拦截和代理Java对象，防止沙箱代码访问主机环境。vm2的 ...

The JavaScript sandbox vm2 for Node.js was actually discontinued. Now an update closes a critical security vulnerability.

虽然CVE-2026-22709已在vm2版本3.10.2中得到修复，但这是近年来困扰该库的一系列沙箱逃逸漏洞中的最新一个。这包括CVE-2022-36067、CVE-2023-29017、CVE-2023-29199、CVE-2023-30547、CVE-2023-32314、CVE-2023-37466和CVE-2023-37903。

Sandbox escape vulnerability in vm2, used by nearly 900 NPM packages, allows attackers to bypass security protections and ...

A critical vm2 Node.js vulnerability (CVE-2026-22709, CVSS 9.8) allows sandbox escape via Promise handler bypass.

A critical-severity vulnerability in the vm2 Node.js sandbox library, tracked as CVE-2026-22709, allows escaping the sandbox and executing arbitrary code on the underlying host system.

Additional details for RenderATL 2026 and the OpenJS Summit, including programming themes and speaker participation, will be announced in the coming months. For more information about RenderATL, ...

A flaw in the binary-parser npm package before version 2.3.0 lets attackers execute arbitrary JavaScript via unsanitized parser input.

Node.js frameworks in 2025 focus on clean structure, strong speed and stability for various backend use cases. Fastify, NestJS and LoopBack lead in performance and enterprise patterns across modern ...