CVE-2026-24120

CVSS 3.1: 9.8 critical
EPSS: <1%p60
Published: May 4, 2026 · May 4, 2026
Modified: Oct 25, 2026

Analyze CVE-2026-24120 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.

Vendors: vm2 project

Products: vm2

Weakness: CWE-94, CWE-693, CWE-807

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news

1 story

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

The Hacker NewsMay 11, 03:55 UTC · May 11, 2026VulnerabilityCVE-2026-24118 CVE-2026-24120 CVE-2023-37466+113 · 2 reads