Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

vm2 component may let attackers run code

CVE-2026-26956 · published 11 days ago
Summary

The vm2 library used in several npm packages can be exploited to execute arbitrary code on your system. This affects installations from GitHub Actions, rootio, patriksimek, and other vm2 releases. Update to the latest patched versions of the vm2 packages as soon as possible.

What to do
  • Update GitHub Actions vm2 to version 3.10.5.
  • Update rootio @rootio/vm2 to version 3.10.5-root.io.6.
  • Update GitHub Actions vm2 to version 3.10.5-aikido.6.
  • Update vm2 to version 3.9.17-aikido.10.
  • Update rootio @rootio/vm2 to version 3.9.17-root.io.10.
  • Update vm2 to version 3.9.7-aikido.6.
  • Update rootio @rootio/vm2 to version 3.9.7-root.io.6.
  • Update vm2_project vm2 to version 3.10.5 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions vm2 3.10.4
<= 3.10.4
Fix: upgrade to 3.10.5
Root:npm rootio @rootio/vm2 < 3.10.5-root.io.6
< 3.9.17-root.io.10
< 3.9.7-root.io.6
Fix: upgrade to 3.10.5-root.io.6
Root:npm GitHub Actions vm2 < 3.10.5-aikido.6
Fix: upgrade to 3.10.5-aikido.6
– patriksimek vm2 = 3.10.4
Root:npm – vm2 < 3.9.17-aikido.10
< 3.9.7-aikido.6
Fix: upgrade to 3.9.17-aikido.10
– vm2_project vm2 < 3.10.5
cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*
Original advisory text
CVE-2026-26956 in vm2 - Patched by Root
Root has patched CVE-2026-26956 in the vm2 package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-693Protection Mechanism Failure
CWE-94Code Injection
CWE-653Improper Isolation or Compartmentalization
Timeline
Published30 Sep 2026
Updated7 Oct 2026
First seen4 May 2026
Sources
ROOT-APP-NPM-CVE-2026-26956 · OSV
CVE-2026-26956 · NVD
GHSA-ffh4-j6h5-pg66 · GHSA
CVE-2026-26956 · MITRE
Track software like this
Free during beta