vm2: Sandbox Escape
Priority HIGH 82CWE-693Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693 and CWE-94.
Summary
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0071 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial vm2 (patriksimek): 3.11.0vm2 (npm): 3.11.0Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| patriksimek | vm2 | before 3.11.0 | 3.11.0 | Patch available | CNA |
| — | vm2 (npm) | before 3.11.0 | 3.11.0 | Patch available | GHSA-55hx-c926-fr95 |
- vm2 Vendorpatriksimek Affected before 3.11.0 Fixed in 3.11.0 Patch available CNA
- vm2 (npm) Vendor— Affected before 3.11.0 Fixed in 3.11.0 Patch available GHSA-55hx-c926-fr95
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* | before 3.11.0 | Vulnerable | patriksimek |
- cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* Versions before 3.11.0 Vulnerable ·patriksimek
Remediation
- Fix · CNA vm2 (patriksimek) Fixed in 3.11.0
- Fix · GHSA-55hx-c926-fr95 vm2 (npm) Fixed in 3.11.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Self-service automation portal 2 | Affected | No fix yet |
Not affected: 1 product
- Red Hat Developer Hub 1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-26332
- 2026-10-03 Alias added: GHSA-55hx-c926-fr95
- 2026-10-27 Affected versions changed · Red Hat
- 2026-11-04 Affected versions changed · GHSA-55hx-c926-fr95
- 2026-11-04 Weakness changed · GHSA-55hx-c926-fr95
- 2026-11-04 3 new references · GHSA-55hx-c926-fr95
References
Other 10
- https://github.com/patriksimek/vm2/releases/tag/v3.11.0
- https://github.com/patriksimek/vm2/commit/119fd0aa1e4c27b08cf37946b2dafa99e2c754f0
- https://github.com/patriksimek/vm2/commit/4cb82cc94d9bb6c9a918b45f8c6790c32a5e913f
- https://github.com/patriksimek/vm2/commit/7395c3a4b01d302e55271c87dbeb44d6b83b81ca
- https://github.com/patriksimek/vm2/commit/792e16d56ee429ab19e284ed9c545f5e4694fb7d
- https://github.com/patriksimek/vm2/commit/d715dd88c5aec5bbb4dce03ddf7c3eb3791d0338
- https://access.redhat.com/security/cve/CVE-2026-26332
- https://bugzilla.redhat.com/show_bug.cgi?id=2466508
- https://github.com/patriksimek/vm2
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26332.json
More patriksimek Vm2 vulnerabilities
- TI-2023-14382 Sandbox Escape in vm2 CVSS 3.1CRITICAL 10.0
- TI-2023-13478 vm2 Sandbox Escape vulnerability CVSS 3.1CRITICAL 10.0
- TI-2026-33200 vm2: Sandbox Breakout Using Async Generator CVSS 3.1CRITICAL 9.8
- TI-2026-32052 vm2: Sandbox Breakout Through Null Proto Exception CVSS 3.1CRITICAL 9.8
- TI-2026-32051 vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` CVSS 3.1CRITICAL 9.8
- TI-2026-32049 vm2: Sandbox Escape CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-26332 · CVE Program
- CVE-2026-26332 · NVD
- FIRST EPSS
- GHSA-55hx-c926-fr95 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-26332 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences