Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-24118: VM2 Sandbox Escape: Host Code Execution
GHSA-grj5-jjm8-h35p
CVE-2026-24118
CVE-2026-24118
Summary
VM2's sandbox is vulnerable to a breach, allowing malicious code to execute on the host system. This means an attacker could potentially take control of your system. To protect yourself, update to the latest version of VM2.
What to do
- Update GitHub Actions vm2 to version 3.11.0.
- Update vm2 to version 3.11.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | vm2 |
<= 3.10.4 Fix: upgrade to 3.11.0
|
| npm | – | vm2 |
<= 3.10.4 Fix: upgrade to 3.11.0
|
| – | vm2_project | vm2 |
< 3.11.0 cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* |
| – | patriksimek | vm2 | < 3.11.0 |
Original title
VM2 Sandbox Breakout Through __lookupGetter__
Original description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
ghsa CVSS3.1
9.8
Vulnerability type
CWE-94
Code Injection
CWE-693
Protection Mechanism Failure
- https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p
- https://github.com/patriksimek/vm2/commit/2b5f3e3a060d9088f5e1cdd585d683d491f990...
- https://github.com/patriksimek/vm2/commit/f9b700b1c7d9ef2df416666cb24e0b659140cc...
- https://github.com/patriksimek/vm2/releases/tag/v3.11.0
- https://github.com/advisories/GHSA-grj5-jjm8-h35p
- https://nvd.nist.gov/vuln/detail/CVE-2026-24118
Published: 4 May 2026 · Updated: 20 Jul 2026 · First seen: 4 May 2026