CVE-2026-24120
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A vulnerability in the vm2 library for Node.js allows bypassing the fix for CVE-2023-37466 and escaping the VM2 sandbox, enabling arbitrary command execution on the host. The issue is patched in version 3.10.5.
Risk Assessment
An attacker can gain full control of the host system by executing arbitrary commands, leading to complete compromise of the environment and data.
Recommendation
Immediately update vm2 to version 3.10.5 or later. If an update is not possible, consider using an alternative code isolation solution.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.