CVE Intelligence
Analysis AI-assisted

CVE-2026-26332: vm2: Sandbox Escape

CVE-2026-26332 affects the open source vm2 sandbox for Node.js. According to the record, versions before 3.11.0 are vulnerable to a sandbox escape through SuppressedError that can lead to arbitrary code execution, and the issue is fixed in 3.11.0. CISA KEV does not list it, and no confirmed active exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

vm2 is an open source sandbox for running code inside Node.js. According to the record, versions before 3.11.0 contain a flaw involving SuppressedError that allows an attacker to escape the sandbox and run arbitrary code. The fix is stated to be in version 3.11.0.

Impact

  • A sandbox escape can move code execution outside the intended isolation boundary.
  • The record classifies the weakness as CWE-94 (Code Injection).
  • CVSS v3.1 scores in the record range from 9.1 to 10 depending on the provider. NVD lists 10 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products and versions

  • Patriksimek Vm2: before 3.11.0.
  • Vm2 Project Vm2: before 3.11.0.

Exploitation status

CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted. The SSVC exploitation value is poc (proof of concept), and one reference is tagged as exploit-related. This suggests public exploit material may exist, but it does not confirm exploitation in the wild.

Remediation and mitigation

  • Upgrade vm2 to 3.11.0, the version the record states contains the fix.
  • Inventory every Node.js project that uses vm2, including transitive dependencies pulled in by other packages.
  • The record does not document a workaround. Reducing exposure to untrusted input is only a compensating measure and is not a substitute for patching.

Detection guidance

  • Check lock files and software bill of materials for vm2 and confirm the resolved version.
  • Identify applications that pass untrusted or user-supplied code to vm2 and prioritize them.
  • Review logs of services that use sandboxed execution for unusual behavior (inference based on the vulnerability class, not a documented indicator).

Limitations of the available information

The record gives only the stated version boundary, does not describe the technical mechanism, and contains no vendor-published workaround. Exploit availability is inferred from the reference tag and the SSVC value, not confirmed. CVSS scores differ across providers and no KEV entry exists.

Frequently asked questions

Which vm2 versions are affected by CVE-2026-26332?

According to the record, versions before 3.11.0 are affected for both listed products, Patriksimek Vm2 and Vm2 Project Vm2.

What is the fix?

The record states the issue is patched in version 3.11.0. The fixes field in the record is empty, so the fix is taken from the description and the release reference.

Is this vulnerability being actively exploited?

CISA KEV does not list it, and no confirmed active exploitation appears in the sources consulted. The SSVC value is poc, so public proof-of-concept material may exist.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.