CVE-2026-24118
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile — higher than 56% of all known CVEs
Summary
A vulnerability in the vm2 library for Node.js allows sandbox escape and arbitrary command execution on the host system. The issue is fixed in version 3.11.0.
Risk Assessment
An attacker can break out of the vm2 sandbox and gain full control over the host system, compromising data confidentiality, integrity, and availability.
Recommendation
Immediately upgrade vm2 to version 3.11.0 or later. If an upgrade is not possible, consider temporarily disabling features that use vm2.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.