CVE-2026-24120
Critical · 9.8CVSS
9.8
EPSS
0.9%
Published
May 4, 2026
CISA due date
—
The record
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | vm2 | 0 | 3.10.5 |
Related vulnerabilities
- GHSA-qvjj-29qf-hp7p VM2 Has Sandbox Breakout Through Promise Species Same vulnerability
- CVE-2026-47210 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47209 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47139 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47208 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47135 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47137 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47141 vm2 is an open source vm/sandbox for Node.js. Also affects vm2