Sandbox Breakout in vm2 Allows Arbitrary Code Execution

Publication date: 2026-05-04

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-24118

Affected Vendors & Products

Vendor	Product	Version / Range
vm2_project	vm2	to 3.11.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-749	The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

The vulnerability exists in vm2, an open source virtual machine and sandbox for Node.js. Prior to version 3.11.0, vm2 has a sandbox breakout vulnerability that allows attackers to write code that escapes the sandbox environment. This means the attacker can execute arbitrary commands on the host system outside the intended isolated environment.

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to execute arbitrary commands on the host system by escaping the sandbox. This can lead to full system compromise, unauthorized access to sensitive data, disruption of services, and potential further exploitation of the affected system.

Mitigation Strategies

To mitigate this vulnerability, upgrade vm2 to version 3.11.0 or later, as this version contains the patch that fixes the sandbox breakout issue.

Hi! I’m here to help you understand CVE-2026-24118. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70