This is highly recommended according to the docs(http://nodejs.org/docs/v0.4.12/api/vm.html#vm.runInNewContext http://nodejs.org/docs/v0.4.12/api/vm.html#vm.run

This is highly recommended according to the docs(http://nodejs.org/docs/v0.4.12/api/vm.html#vm.runInNewContext http://nodejs.org/docs/v0.4.12/api/vm.html#vm.runInNewContex...): "Note that running untrusted code is a tricky business requiring great care. To prevent accidental global variable leakage, script.runInNewContext is quite useful, but safely running untrusted code requires a separate process." So IMHO, it's a good start but is not quite there yet, I'm not an expert in security but I don't think just because you are using V8 and a separate process model doesn't mean you will achieve the same level of sandboxing that Chromium provides. In fact, Chromium relies a lot in several security mechanism of the OS: Windows: http://www.chromium.org/developers/design-documents/sandbox http://www.chromium.org/developers/design-documents/sandbox Linux: http://code.google.com/p/chromium/wiki/LinuxSandboxing http://code.google.com/p/chromium/wiki/LinuxSandboxing OSX: http://www.chromium.org/developers/design-documents/sandbox/osx-sandboxing-design http://www.chromium.org/developers/design-documents/sandbox/... So if you just want to keep your globals clean, running the code in a separate V8 Context is more than enough, I did it once for a javascript library that was corrupting one of my global types(https://github.com/firebaseco/safe_datejs https://github.com/firebaseco/safe_datejs). We are in a Cloud era, if you really need to run untrusted code on the server side you should be using Virtual Machines instead of a processes, or even better, create a web hook for your web app. I like the initiative but I'm having a hard time trying to find a use case for this.