CVE-2026-24781
Critical · 9.8CVSS
9.8
EPSS
1.2%
Published
May 4, 2026
CISA due date
—
The record
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | vm2 | 0 | 3.11.0 |
Related vulnerabilities
- GHSA-v37h-5mfm-c47c VM2 Has Sandbox Breakout Through Inspect Function Same vulnerability
- CVE-2026-47210 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47209 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47139 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47208 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47135 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47137 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47141 vm2 is an open source vm/sandbox for Node.js. Also affects vm2