Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-26332: vm2 Sandbox Escape in Node.js Versions Prior to 3.11.0
CVE-2026-26332
GHSA-55hx-c926-fr95
CVE-2026-26332
Summary
A security issue in older versions of vm2 for Node.js allows attackers to break out of a secure environment and run their own code. This is a serious risk, especially for servers hosting untrusted code. To fix the issue, update to version 3.11.0 or later.
What to do
- Update vm2 to version 3.11.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | – | vm2 |
<= 3.10.4 Fix: upgrade to 3.11.0
|
| – | patriksimek | vm2 | < 3.11.0 |
Original title
vm2: Sandbox Escape
Original description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
nvd CVSS3.1
9.8
Vulnerability type
CWE-94
Code Injection
CWE-693
Protection Mechanism Failure
- https://github.com/patriksimek/vm2/releases/tag/v3.11.0
- https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95
- https://nvd.nist.gov/vuln/detail/CVE-2026-26332
- https://github.com/patriksimek/vm2/commit/119fd0aa1e4c27b08cf37946b2dafa99e2c754...
- https://github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e91...
- https://github.com/patriksimek/vm2/commit/7395c3a4b01d302e55271c87dbeb44d6b83b81...
- https://github.com/patriksimek/vm2/commit/792e16d56ee429ab19e284ed9c545f5e4694fb...
- https://github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d03...
- https://github.com/advisories/GHSA-55hx-c926-fr95
Published: 4 May 2026 · Updated: 16 Jul 2026 · First seen: 4 May 2026