p PatchFirst

CVE-2026-24120

CVE-2026-24120 · vm2: Sandbox Breakout Through Promise Species

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.

CVSS 9.8 · Critical · EPSS 0.9% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vm2

    Versions
    • < 3.10.5: Affected

    No fix published

  • vm2 npm

    Affected ranges
    • SEMVER: < 3.10.5

    Update to 3.10.5

Original sources

Check your server →