CVE-2026-26332

CriticalCVSS 9.8

Published: 04/05/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.71%

49th percentile - higher than 49% of all known CVEs

Summary

A vulnerability in the vm2 library for Node.js allows attackers to escape the sandbox and execute arbitrary code via the SuppressedError mechanism. The issue is fixed in version 3.11.0.

Risk Assessment

An attacker can gain full control over the Node.js application, leading to compromise of data confidentiality, integrity, and system availability.

Recommendation

Immediately upgrade vm2 to version 3.11.0 or later. If upgrade is not possible, consider temporarily disabling the SuppressedError feature.

Original NVD description (English source)

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.