CVE-2026-26956
Critical · 9.8CVSS
9.8
EPSS
0.9%
Published
May 4, 2026
CISA due date
—
The record
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | vm2 | 0 | 3.10.5 |
Related vulnerabilities
- GHSA-ffh4-j6h5-pg66 VM2 Has a WASM Sandbox Escape Same vulnerability
- CVE-2026-47210 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47209 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47139 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47208 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47135 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47137 vm2 is an open source vm/sandbox for Node.js. Also affects vm2
- CVE-2026-47141 vm2 is an open source vm/sandbox for Node.js. Also affects vm2