A critical-severity vulnerability in the vm2 Node.js sandbox library, tracked as CVE-2026-22709, allows escaping the sandbox and executing arbitrary code on the underlying host system.

This is useful, e.g., if your project contains a lot of image files and you lost track which images are still in use. A file is considered "used" when it is referenced in at least one Markdown file of ...