CVE-2026-45411: vm2 Sandbox Breakout Vulnerability via Async Generator
Summary
CVE-2026-45411: vm2 Has a Sandbox Breakout Using Async Generator. Affects vm2 versions < 3.11.3. Fixed in 3.11.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js library that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code without risking the host system's integrity. However, a critical vulnerability has been identified that enables attackers to escape the sandbox and execute arbitrary commands on the host system, compromising security.
Vulnerability Detail
The vulnerability arises from the ability to catch host exceptions using the yield* expression within an async generator. When the generator is closed using the return function, the value is awaited, and exceptions thrown in the then call are passed to the yield* iterator as the next value. This flaw allows attackers to manipulate the execution flow and potentially execute malicious code outside the sandbox, leading to remote code execution.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.3
This is the first release that contains the fix.
npm install vm2@3.11.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using async generators in your code when executing untrusted code within the vm2 sandbox. This can help mitigate the risk until you can update to the patched version.
Conclusion
The vm2 package has a critical vulnerability (CVE-2026-45411) that allows sandbox breakout through async generators. It is essential to update to version 3.11.3 or later to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in your applications.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application by visiting the Vulert playground at Vulert Scanner without needing to sign up.
If exploited, this vulnerability allows attackers to execute arbitrary commands on the host system, which can lead to data breaches, system compromise, and other severe security incidents.
Yes, as a temporary measure, avoid using async generators in your code when executing untrusted code within the vm2 sandbox.
You can find more information on the official GitHub repository of vm2 and security advisories related to it.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
