CVE-2026-24118
Critical · CVSS 9.8vm2 — Sandbox Breakout / Arbitrary Code Execution
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-94, CWE-693, CWE-749
Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
Search profile — drives PoC discovery
Symbols VM2vm2sandboxbreakoutpatriksimekGHSA-grj5-jjm8-h35p2b5f3e3a060d9088f5e1cdd585d683d491f990a3f9b700b1c7d9ef2df416666cb24e0b659140cc74
Keywords CVE-2026-24118vm2 sandbox breakoutvm2 RCEvm2 escapevm2 3.11.0GHSA-grj5-jjm8-h35ppatriksimek vm2 exploitNode.js vm2 sandbox escape PoCvm2 arbitrary command execution
Versions: < 3.11.0
Ranked PoCs (2) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
- ★ 0
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
- https://github.com/patriksimek/vm2/commit/2b5f3e3a060d9088f5e1cdd585d683d491f990a3
- https://github.com/patriksimek/vm2/commit/f9b700b1c7d9ef2df416666cb24e0b659140cc74
- https://github.com/patriksimek/vm2/releases/tag/v3.11.0
- https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p
- https://access.redhat.com/security/cve/CVE-2026-24118
- https://bugzilla.redhat.com/show_bug.cgi?id=2466502
- https://github.com/patriksimek/vm2/security/advisories/GHSA-grj5-jjm8-h35p
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24118.json
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-06-30T18:30:14.000Z