Critical Vulnerability in VM2 Sandbox Library for Node.js Let Attackers run Untrusted Code

A critical sandbox-escape vulnerability (CVE-2026-22709, CVSS 10.0) in the vm2 Node.js package (affecting versions ≤ 3.10.0) allows attackers to bypass sandbox isolation via Promise.prototype sanitization asymmetry, enabling arbitrary code execution (demonstrated via Function and child_process). Maintainers released vm2 3.10.2 to patch the issue; organizations should urgently inventory affected deployments and upgrade or restrict VM2 execution contexts until patched.