CVE-2026-24118
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
VM2 is an open source VM/sandbox for Node.js. Prior to version 3.11.0, it suffers from a sandbox breakout vulnerability allowing attackers to execute arbitrary commands on the host system.
Risk Assessment
The risk for the organization is the potential for complete host system compromise, enabling data theft, malware installation, or further attacks on the infrastructure.
Recommendation
Immediately update the vm2 library to version 3.11.0 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.