CVE-2026-26956
Critical · CVSS 9.8vm2 — Sandbox Escape with Arbitrary Code Execution
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-693, CWE-653
Description
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.
Search profile — drives PoC discovery
Symbols VM.runvm2patriksimek/vm2GHSA-ffh4-j6h5-pg66host process objectsandbox escape
Keywords CVE-2026-26956vm2 sandbox escapevm2 3.10.4 RCEvm2 arbitrary code executionvm2 Node.js sandbox bypassvm2 VM.run exploitvm2 host process escapeGHSA-ffh4-j6h5-pg66 PoCpatriksimek vm2 exploitvm2 3.10.4 PoC
Versions: <= 3.10.4
Ranked PoCs (1) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
- https://github.com/patriksimek/vm2/releases/tag/v3.10.5
- https://github.com/patriksimek/vm2/security/advisories/GHSA-ffh4-j6h5-pg66
- https://access.redhat.com/security/cve/CVE-2026-26956
- https://bugzilla.redhat.com/show_bug.cgi?id=2466548
- https://github.com/patriksimek/vm2/security/advisories/GHSA-ffh4-j6h5-pg66
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26956.json
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T00:30:14.000Z