---
id: 7468
title: "Critical remote code execution in vm2, a widely used Node.js sandbox library"
source_domain: about.gitlab.com
source_url: "https://about.gitlab.com/blog/critical-remote-code-execution-in-vm2/"
published_at: "2026-09-02T00:00:00Z"
tags: ["rce", "gitlab", "sandbox-escape", "vulnerability", "nodejs", "vm2"]
phying_url: "https://phying.com/item/7468"
lang: en
---

# Critical remote code execution in vm2, a widely used Node.js sandbox library

## Summary

GitLab's Threat Research Group found a critical vm2 sandbox escape (CVSS 10.0) reachable with require.external enabled per the library's README; v3.11.7 blocks it, but config hardening is still urged.

## Intelligence Metadata

- **Sources:** about.gitlab.com
- **Published:** 2026-09-02T00:00:00Z
- **Original:** https://about.gitlab.com/blog/critical-remote-code-execution-in-vm2/
- **Phying News:** https://phying.com/item/7468