CVE-2026-26956
EUVD-2026-2699504.05.2026, 17:16
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| vm2_project | vm2 | 𝑥 < 3.10.5 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-693 - Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
- CWE-653 - Improper Isolation or CompartmentalizationThe product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
References