CVE-2026-24118
May 4, 2026
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and ...
Read Advisory
Vm2 Project Vm2 Vulnerabilities
5 advisories affecting Vm2 Project Vm2
5
Total CVEs
5
Critical
0
High
CVE-2026-24120
May 4, 2026
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2...
Read Advisory
CVE-2026-24781
May 4, 2026
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can esc...
Read Advisory
CVE-2026-26332
May 4, 2026
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0....
Read Advisory
CVE-2026-26956
May 4, 2026
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and r...
Read Advisory