Vulnerability · Published May 4, 2026 · Assigned by GitHub_M

CVE-2026-24120vm2: Sandbox Breakout Through Promise Species

Critical 9.8

In plain English

A critical-severity code injection in vm2 from patriksimek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.9%top 40.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	vm2	3.10.5	GHSA-qvjj-29qf-hp7p

Affected products (as reported)

Vendor	Product	Versions
patriksimek	vm2	< 3.10.5

Weakness: CWE-693, CWE-94, CWE-807 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/patriksimek/vm2/security/advisories/GHSA-qvjj-29qf-hp7p x_refsource_CONFIRM
https://github.com/patriksimek/vm2/releases/tag/v3.10.5 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-24120 vdb-entry, x_refsource_REDHAT
RHBZ#2466529 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24120.json x_sadp-csaf-vex