Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-24781: vm2 library can allow unauthorized code execution
CVE-2026-24781 · published 3 days ago
Summary
The vm2 sandbox tool used in several projects could let bad code run on your system. This risk has been fixed in the latest releases of vm2. Update all vm2 installations to the newest version as soon as possible.
What to do
- Update GitHub Actions vm2 to version 3.11.0.
- Update vm2 to version 3.9.17-aikido.10.
- Update rootio @rootio/vm2 to version 3.9.17-root.io.10.
- Update rootio @rootio/vm2 to version 3.10.5-root.io.3.
- Update rootio @rootio/vm2 to version 3.10.5-root.io.4.
- Update rootio @rootio/vm2 to version 3.10.5-root.io.5.
- Update rootio @rootio/vm2 to version 3.10.5-root.io.6.
- Update GitHub Actions vm2 to version 3.10.5-aikido.6.
- Update rootio @rootio/vm2 to version 3.9.17-root.io.7.
- Update GitHub Actions vm2 to version 3.9.17-aikido.7.
- Update rootio @rootio/vm2 to version 3.9.17-root.io.9.
- Update GitHub Actions vm2 to version 3.9.17-aikido.9.
- Update vm2_project vm2 to version 3.11.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | vm2 |
<= 3.10.3 Fix: upgrade to 3.11.0
|
| Root:npm | – | vm2 |
< 3.9.17-aikido.10 Fix: upgrade to 3.9.17-aikido.10
|
| Root:npm | rootio | @rootio/vm2 |
< 3.9.17-root.io.10 < 3.10.5-root.io.3 < 3.10.5-root.io.4 < 3.10.5-root.io.5 < 3.10.5-root.io.6 < 3.9.17-root.io.7 < 3.9.17-root.io.9 Fix: upgrade to 3.9.17-root.io.10
|
| Root:npm | GitHub Actions | vm2 |
< 3.10.5-aikido.6 < 3.9.17-aikido.7 < 3.9.17-aikido.9 Fix: upgrade to 3.10.5-aikido.6
|
| – | patriksimek | vm2 | < 3.11.0 |
| – | vm2_project | vm2 |
< 3.11.0 cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* |
Original advisory text
CVE-2026-24781 in vm2 - Patched by Root
Root has patched CVE-2026-24781 in the vm2 package for Root:npm. Multiple fixed versions available.
References
- https://github.com/patriksimek/vm2/commit/8d30d93213c1898b3e035298b89a814970dd11...
- https://github.com/patriksimek/vm2/commit/bdd3d15e57bc4ec5e70365cd79f7cb0256e5f8...
- https://github.com/patriksimek/vm2/commit/fd266d084e0a3322d0f71ba2a8dc4c96cd0302...
- https://github.com/patriksimek/vm2/releases/tag/v3.11.0
- https://github.com/patriksimek/vm2/security/advisories/GHSA-v37h-5mfm-c47c
- https://nvd.nist.gov/vuln/detail/CVE-2026-24781
- https://github.com/advisories/GHSA-v37h-5mfm-c47c
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/security/cve/CVE-2026-24781
- https://bugzilla.redhat.com/show_bug.cgi?id=2466531
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24781.json
Severity
9.8
Critical
CVSS 3.1: 9.8 (NVD)
CVSS 3.1: 9.8 (OSV)
Exploitation
EPSS 1%
Type
CWE-94Code Injection
CWE-693Protection Mechanism Failure
CWE-653Improper Isolation or Compartmentalization
Timeline
Published22 Sep 2026
Updated22 Sep 2026
First seen4 May 2026
Track software like this
Free during beta