I would like to have the ability to let users submit arbitrary JavaScript code, which is then sent to a Node.JS server and safely executed before the output is sent back to
This answer is outdated as gf3 does not provide protection against sandbox breaking
http://gf3.github.io/sandbox/ - it uses require('child_process') instead of require('vm').
require('child_process')
require('vm')