vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
References
| Link | Resource |
|---|---|
| https://github.com/patriksimek/vm2/commit/2b5f3e3a060d9088f5e1cdd585d683d491f990a3 | Patch |
| https://github.com/patriksimek/vm2/commit/f9b700b1c7d9ef2df416666cb24e0b659140cc74 | Patch |
| https://github.com/patriksimek/vm2/releases/tag/v3.11.0 | Release Notes |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p | Exploit Vendor Advisory |
| https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p | Exploit Vendor Advisory |
Configurations
History
08 May 2026, 19:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* | |
| First Time |
Vm2 Project vm2
Vm2 Project |
|
| References | () https://github.com/patriksimek/vm2/commit/2b5f3e3a060d9088f5e1cdd585d683d491f990a3 - Patch | |
| References | () https://github.com/patriksimek/vm2/commit/f9b700b1c7d9ef2df416666cb24e0b659140cc74 - Patch | |
| References | () https://github.com/patriksimek/vm2/releases/tag/v3.11.0 - Release Notes | |
| References | () https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p - Exploit, Vendor Advisory |
04 May 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p - |
04 May 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-04 17:16
Updated : 2026-05-08 19:30
NVD link : CVE-2026-24118
Mitre link : CVE-2026-24118
CVE.ORG link : CVE-2026-24118
JSON object : View
Products Affected
vm2_project
- vm2