HarborGuard / CVE
Back to search
CRITICALCVE-2026-26332Published Modified CNA GitHub_M

CVE-2026-26332: vm2: Sandbox Escape

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.

Metrics

CVSS v3.1
9.8
Severity
CRITICAL
Fixed in
—
Affected Products
1
Affected packages
  • patriksimek / vm2
    < 3.11.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References