CVE-2026-26956
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A vulnerability in the vm2 library for Node.js version 3.10.4 allows full sandbox escape with arbitrary code execution. An attacker can obtain the host process object and run host commands without any host cooperation.
Risk Assessment
The risk for the organization is critical, as an attacker can take control of the server, steal data, or install malware by fully escaping the sandbox.
Recommendation
Immediately update the vm2 library to version 3.10.5 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.