CVE-2026-26332

EUVD-2026-26993
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
Affected Products (NVD)
VendorProductVersion
vm2_projectvm2
𝑥
< 3.11.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/patriksimek/vm2/releases/tag/v3.11.0
https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95
https://github.com/patriksimek/vm2/security/advisories/GHSA-55hx-c926-fr95