The page explicitly says: "Note: The vm module is not a security mechanism. Do not use it to run untrusted code."

https://nodejs.org/api/vm.html#vm_vm_executing_javascript