A critical vm2 Node.js vulnerability (CVE-2026-22709, CVSS 9.8) allows sandbox escape via Promise handler bypass.

Sandbox escape vulnerability in vm2, used by nearly 900 NPM packages, allows attackers to bypass security protections and ...

流行的vm2 Node.js库近日披露一个高危沙箱逃逸漏洞，攻击者成功利用该漏洞可在底层操作系统上执行任意代码。该漏洞编号为CVE-2026-22709，CVSS评分为9.8分（满分10分）。

The JavaScript sandbox vm2 for Node.js was actually discontinued. Now an update closes a critical security vulnerability.

Two vulnerabilities in n8n’s sandbox mechanism could be exploited for remote code execution (RCE) on the host system.

Overview: Programmers prefer Python in AI, data science, and machine learning projects, while JavaScript is useful in web and full-stack development.GitHub and ...

Dahl在2009年一手搞出Node.js，推动了异步I/O和事件驱动编程的普及，让JavaScript从浏览器杀到服务器，改变了整个后端生态，同时这个框架也经常被用于前端工程化工具的开发。

A critical-severity vulnerability in the vm2 Node.js sandbox library, tracked as CVE-2026-22709, allows escaping the sandbox and executing arbitrary code on the underlying host system.

虽然CVE-2026-22709已在vm2版本3.10.2中得到修复，但这是近年来困扰该库的一系列沙箱逃逸漏洞中的最新一个。这包括CVE-2022-36067、CVE-2023-29017、CVE-2023-29199、CVE-2023-30547、CVE-2023-32314、CVE-2023-37466和CVE-2023-37903。

近期，流行的Node.js库vm2被发现存在严重的沙箱逃逸漏洞，编号为CVE-2026-22709。该漏洞的CVSS评分高达9.8（满分10.0），意味着其潜在风险极高。如果攻击者成功利用该漏洞，可能在底层操作系统上执行任意代码，这对于依赖该库的应用程序安全构成重大威胁。 vm2库是用于在安全沙箱环境中运行不可信代码的工具，其设计初衷是通过拦截和代理Java对象，防止沙箱代码访问主机环境。vm2的 ...

Additional details for RenderATL 2026 and the OpenJS Summit, including programming themes and speaker participation, will be announced in the coming months. For more information about RenderATL, ...

Available in a technical preview, the SDK for Node.js, Python, Go, and .NET provides programmatic access to the agentic power ...