vm2 Sandbox for Node.js: Critical vulnerabilities patched in version 3.11.8

The vm2 sandbox for Node.js is affected by several critical security vulnerabilities that allow for sandbox escapes. The German Federal Office for Information Security (BSI) has issued a warning regarding these flaws, which affect all versions prior to 3.11.8 across UNIX, Windows, and other operating systems.

Six specific vulnerabilities have been identified, including CVE-2026-92955, which carries a maximum CVSS score of 10.0. Attackers can exploit these weaknesses to execute arbitrary code on the host system, bypass security measures, manipulate data, or trigger denial-of-service conditions. One particularly severe method involves manipulating the internal properties of NodeVM/Node.js console objects, such as ‘console._stdout’ and ‘console._stderr’, to access and modify host prototypes.

Operators using vm2 to run untrusted or partially controlled code are urged to update to version 3.11.8 immediately to mitigate these risks.